You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/cmd/k8s-operator
Irbe Krumina eabb424275
cmd/k8s-operator,docs/k8s: run tun mode proxies in privileged containers (#14262)
We were previously relying on unintended behaviour by runc where
all containers where by default given read/write/mknod permissions
for tun devices.
This behaviour was removed in https://github.com/opencontainers/runc/pull/3468
and released in runc 1.2.
Containerd container runtime, used by Docker and majority of Kubernetes distributions
bumped runc to 1.2 in 1.7.24 https://github.com/containerd/containerd/releases/tag/v1.7.24
thus breaking our reference tun mode Tailscale Kubernetes manifests and Kubernetes
operator proxies.

This PR changes the all Kubernetes container configs that run Tailscale in tun mode
to privileged. This should not be a breaking change because all these containers would
run in a Pod that already has a privileged init container.

Updates tailscale/tailscale#14256
Updates tailscale/tailscale#10814

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
1 year ago
..
deploy cmd/k8s-operator,docs/k8s: run tun mode proxies in privileged containers (#14262) 1 year ago
generate cmd/k8s-operator,k8s-operator: add ProxyGroup CRD (#13591) 1 year ago
connector.go cmd/k8s-operator,k8s-operator,kube/kubetypes: add an option to configure app connector via Connector spec (#13950) 1 year ago
connector_test.go cmd/k8s-operator,k8s-operator,kube/kubetypes: add an option to configure app connector via Connector spec (#13950) 1 year ago
depaware.txt derp/derphttp: don't link websockets other than on GOOS=js 1 year ago
dnsrecords.go cmd/k8s-operator: fix DNS reconciler for dual-stack clusters (#13057) 1 year ago
dnsrecords_test.go cmd/k8s-operator: fix DNS reconciler for dual-stack clusters (#13057) 1 year ago
egress-eps.go cmd/k8s-operator: fix Pod IP selection (#13743) 1 year ago
egress-eps_test.go cmd/k8s-operator: fix Pod IP selection (#13743) 1 year ago
egress-services-readiness.go cmd/k8s-operator,k8s-operator/apis: set a readiness condition on egress Services for ProxyGroup (#13746) 1 year ago
egress-services-readiness_test.go cmd/k8s-operator,k8s-operator/apis: set a readiness condition on egress Services for ProxyGroup (#13746) 1 year ago
egress-services.go cmd/k8s-operator: fix port name change bug for egress ProxyGroup proxies (#14247) 1 year ago
egress-services_test.go cmd/k8s-operator: fix port name change bug for egress ProxyGroup proxies (#14247) 1 year ago
ingress.go cmd/k8s-operator,k8s-operator: use default ProxyClass if set for ProxyGroup (#13720) 1 year ago
ingress_test.go cmd/k8s-operator,k8s-operator: use default ProxyClass if set for ProxyGroup (#13720) 1 year ago
nameserver.go kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware.txt: rename packages (#13418) 1 year ago
nameserver_test.go cmd/k8s-operator,k8s-operator,kube: Add TSRecorder CRD + controller (#13299) 1 year ago
operator.go cmd/k8s-operator: allow to optionally configure tailscaled port (#14005) 1 year ago
operator_test.go cmd/k8s-operator: always set stateful filtering to false (#14216) 1 year ago
proxy.go kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware.txt: rename packages (#13418) 1 year ago
proxy_test.go cmd/k8s-operator,ssh/tailssh,tsnet: optionally record 'kubectl exec' sessions via Kubernetes operator's API server proxy (#12274) 1 year ago
proxyclass.go cmd/{containerboot,k8s-operator},k8s-operator: new options to expose user metrics (#14035) 1 year ago
proxyclass_test.go cmd/{containerboot,k8s-operator},k8s-operator: new options to expose user metrics (#14035) 1 year ago
proxygroup.go cmd/k8s-operator: restart ProxyGroup pods less (#14045) 1 year ago
proxygroup_specs.go kube/{kubeapi,kubeclient},ipn/store/kubestore,cmd/{containerboot,k8s-operator}: emit kube store Events (#14112) 1 year ago
proxygroup_test.go cmd/k8s-operator: restart ProxyGroup pods less (#14045) 1 year ago
sts.go cmd/containerboot: serve health on local endpoint (#14246) 1 year ago
sts_test.go cmd/containerboot: serve health on local endpoint (#14246) 1 year ago
svc.go cmd/k8s-operator: validate that tailscale.com/tailnet-ip annotation value is a valid IP 1 year ago
testutils_test.go cmd/k8s-operator,docs/k8s: run tun mode proxies in privileged containers (#14262) 1 year ago
tsrecorder.go cmd/{containerboot,k8s-operator},k8s-operator,kube: add ProxyGroup controller (#13684) 1 year ago
tsrecorder_specs.go cmd/k8s-operator,kube/kubeclient,docs/k8s: update rbac to emit events + small fixes (#14164) 1 year ago
tsrecorder_specs_test.go cmd/k8s-operator,k8s-operator,kube: Add TSRecorder CRD + controller (#13299) 1 year ago
tsrecorder_test.go cmd/{containerboot,k8s-operator},k8s-operator,kube: add ProxyGroup controller (#13684) 1 year ago