You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Irbe Krumina c62b0732d2 cmd/k8s-operator: remove auth key once proxy has logged in (#13612) ... The operator creates a non-reusable auth key for each of the cluster proxies that it creates and puts in the tailscaled configfile mounted to the proxies. The proxies are always tagged, and their state is persisted in a Kubernetes Secret, so their node keys are expected to never be regenerated, so that they don't need to re-auth. Some tailnet configurations however have seen issues where the auth keys being left in the tailscaled configfile cause the proxies to end up in unauthorized state after a restart at a later point in time. Currently, we have not found a way to reproduce this issue, however this commit removes the auth key from the config once the proxy can be assumed to have logged in. If an existing, logged-in proxy is upgraded to this version, its redundant auth key will be removed from the conffile. If an existing, logged-in proxy is downgraded from this version to a previous version, it will work as before without re-issuing key as the previous code did not enforce that a key must be present. Updates tailscale/tailscale#13451 Signed-off-by: Irbe Krumina <irbe@tailscale.com>		1 month ago
..
deploy	cmd/k8s-operator,k8s-operator: add ProxyGroup CRD (#13591)	1 month ago
generate	cmd/k8s-operator,k8s-operator: add ProxyGroup CRD (#13591)	1 month ago
connector.go	kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware.txt: rename packages (#13418)	2 months ago
connector_test.go	kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware.txt: rename packages (#13418)	2 months ago
depaware.txt	kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware.txt: rename packages (#13418)	2 months ago
dnsrecords.go	cmd/k8s-operator: fix DNS reconciler for dual-stack clusters (#13057)	3 months ago
dnsrecords_test.go	cmd/k8s-operator: fix DNS reconciler for dual-stack clusters (#13057)	3 months ago
ingress.go	kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware.txt: rename packages (#13418)	2 months ago
ingress_test.go	kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware.txt: rename packages (#13418)	2 months ago
nameserver.go	kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware.txt: rename packages (#13418)	2 months ago
nameserver_test.go	cmd/k8s-operator,k8s-operator,kube: Add TSRecorder CRD + controller (#13299)	2 months ago
operator.go	cmd/k8s-operator,k8s-operator,kube: Add TSRecorder CRD + controller (#13299)	2 months ago
operator_test.go	cmd/k8s-operator: remove auth key once proxy has logged in (#13612)	1 month ago
proxy.go	kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware.txt: rename packages (#13418)	2 months ago
proxy_test.go	…
proxyclass.go	…
proxyclass_test.go	…
sts.go	cmd/k8s-operator: remove auth key once proxy has logged in (#13612)	1 month ago
sts_test.go	…
svc.go	kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware.txt: rename packages (#13418)	2 months ago
testutils_test.go	cmd/k8s-operator: remove auth key once proxy has logged in (#13612)	1 month ago
tsrecorder.go	cmd/k8s-operator,k8s-operator: add ProxyGroup CRD (#13591)	1 month ago
tsrecorder_specs.go	cmd/k8s-operator,k8s-operator,kube: Add TSRecorder CRD + controller (#13299)	2 months ago
tsrecorder_specs_test.go	cmd/k8s-operator,k8s-operator,kube: Add TSRecorder CRD + controller (#13299)	2 months ago
tsrecorder_test.go	cmd/k8s-operator,k8s-operator: add ProxyGroup CRD (#13591)	1 month ago