You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Irbe Krumina c3e2b7347b tailcfg,cmd/k8s-operator,kube: move Kubernetes cap to a location that can be shared with control (#12236) ... This PR is in prep of adding logic to control to be able to parse tailscale.com/cap/kubernetes grants in control: - moves the type definition of PeerCapabilityKubernetes cap to a location shared with control. - update the Kubernetes cap rule definition with fields for granting kubectl exec session recording capabilities. - adds a convenience function to produce tailcfg.RawMessage from an arbitrary cap rule and a test for it. An example grant defined via ACLs: "grants": [{ "src": ["tag:eng"], "dst": ["tag:k8s-operator"], "app": { "tailscale.com/cap/kubernetes": [{ "recorder": ["tag:my-recorder"] “enforceRecorder”: true }], }, } ] This grant enforces `kubectl exec` sessions from tailnet clients, matching `tag:eng` via API server proxy matching `tag:k8s-operator` to be recorded and recording to be sent to a tsrecorder instance, matching `tag:my-recorder`. The type needs to be shared with control because we want control to parse this cap and resolve tags to peer IPs. Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>		4 months ago
..
deploy	cmd/k8s-operator,k8s-operator: allow proxies accept advertized routes. (#12388)	4 months ago
generate	cmd/k8s-operator: cleanup runReconciler signature (#11993)	5 months ago
connector.go	cmd/k8s-operator,k8s-operator: allow proxies accept advertized routes. (#12388)	4 months ago
connector_test.go	cmd/k8s-operator,k8s-operator: allow proxies accept advertized routes. (#12388)	4 months ago
dnsrecords.go	cmd/{k8s-operator,k8s-nameserver},k8s-operator: update nameserver config with records for ingress/egress proxies (#11019)	5 months ago
dnsrecords_test.go	cmd/{k8s-operator,k8s-nameserver},k8s-operator: update nameserver config with records for ingress/egress proxies (#11019)	5 months ago
ingress.go	cmd/k8s-operator,k8s-operator: allow proxies accept advertized routes. (#12388)	4 months ago
ingress_test.go	cmd/k8s-operator,k8s-operator: allow proxies accept advertized routes. (#12388)	4 months ago
nameserver.go	cmd/k8s-operator: default nameserver image to tailscale/k8s-nameserver:unstable (#11991)	5 months ago
nameserver_test.go	cmd/k8s-operator: default nameserver image to tailscale/k8s-nameserver:unstable (#11991)	5 months ago
operator.go	go generate directives reorder for 'make kube-generate-all' (#12210)	4 months ago
operator_test.go	cmd/k8s-operator,k8s-operator: allow proxies accept advertized routes. (#12388)	4 months ago
proxy.go	tailcfg,cmd/k8s-operator,kube: move Kubernetes cap to a location that can be shared with control (#12236)	4 months ago
proxy_test.go	tailcfg,cmd/k8s-operator,kube: move Kubernetes cap to a location that can be shared with control (#12236)	4 months ago
proxyclass.go	cmd/k8s-operator,k8s-operator,go.{mod,sum}: make individual proxy images/image pull policies configurable (#11928)	4 months ago
proxyclass_test.go	cmd/k8s-operator,k8s-operator,go.{mod,sum}: make individual proxy images/image pull policies configurable (#11928)	4 months ago
sts.go	cmd/k8s-operator,k8s-operator: allow proxies accept advertized routes. (#12388)	4 months ago
sts_test.go	cmd/k8s-operator,k8s-operator,go.{mod,sum}: make individual proxy images/image pull policies configurable (#11928)	4 months ago
svc.go	cmd/k8s-operator,k8s-operator: allow proxies accept advertized routes. (#12388)	4 months ago
testutils_test.go	cmd/k8s-operator,k8s-operator: allow proxies accept advertized routes. (#12388)	4 months ago