You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/k8s-operator
Irbe Krumina eabb424275
cmd/k8s-operator,docs/k8s: run tun mode proxies in privileged containers (#14262)
We were previously relying on unintended behaviour by runc where
all containers where by default given read/write/mknod permissions
for tun devices.
This behaviour was removed in https://github.com/opencontainers/runc/pull/3468
and released in runc 1.2.
Containerd container runtime, used by Docker and majority of Kubernetes distributions
bumped runc to 1.2 in 1.7.24 https://github.com/containerd/containerd/releases/tag/v1.7.24
thus breaking our reference tun mode Tailscale Kubernetes manifests and Kubernetes
operator proxies.

This PR changes the all Kubernetes container configs that run Tailscale in tun mode
to privileged. This should not be a breaking change because all these containers would
run in a Pod that already has a privileged init container.

Updates tailscale/tailscale#14256
Updates tailscale/tailscale#10814

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
1 year ago
..
apis cmd/k8s-operator,docs/k8s: run tun mode proxies in privileged containers (#14262) 1 year ago
sessionrecording sessionrecording: implement v2 recording endpoint support (#14105) 1 year ago
api-docs-config.yaml go.{mod,sum},tstest/tools,k8s-operator,cmd/k8s-operator: autogenerate CRD API docs (#12884) 1 year ago
api.md cmd/k8s-operator,docs/k8s: run tun mode proxies in privileged containers (#14262) 1 year ago
conditions.go cmd/k8s-operator,k8s-operator: use default ProxyClass if set for ProxyGroup (#13720) 1 year ago
conditions_test.go cmd/k8s-operator,k8s-operator,go.{mod,sum}: publish proxy status condition for annotated services (#12463) 2 years ago
utils.go cmd/{k8s-operator,containerboot},k8s-operator: remove support for proxies below capver 95. (#13986) 1 year ago