TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-07-29 15:23:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

cmd/k8s-operator: ProxyClass annotation for Services and Ingresses (#16363)

Browse Source 
* cmd/k8s-operator: ProxyClass annotation for Services and Ingresses

Previously, the ProxyClass could only be configured for Services and
Ingresses via a Label. This adds the ability to set it via an
Annotation, but prioritizes the Label if both a Label and Annotation are
set.

Updates #14323

Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>

* Update cmd/k8s-operator/operator.go

Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
Signed-off-by: Tom Meadows <tom@tmlabs.co.uk>

* Update cmd/k8s-operator/operator.go

Signed-off-by: Tom Meadows <tom@tmlabs.co.uk>

* cmd/k8s-operator: ProxyClass annotation for Services and Ingresses

Previously, the ProxyClass could only be configured for Services and
Ingresses via a Label. This adds the ability to set it via an
Annotation, but prioritizes the Label if both a Label and Annotation are
set.

Updates #14323

Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>

---------

Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
Signed-off-by: Tom Meadows <tom@tmlabs.co.uk>
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
This commit is contained in:
Tom Meadows 2025-06-30 12:08:35 +01:00 committed by GitHub
parent f85e4bcb32
commit 2fc247573b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
6 changed files with 398 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cmd/k8s-operator/ingress.go
View File

@ -34,6 +34,7 @@ const (
tailscaleIngressClassName = "tailscale" // ingressClass.metadata.name for tailscale IngressClass resource
tailscaleIngressControllerName = "tailscale.com/ts-ingress" // ingressClass.spec.controllerName for tailscale IngressClass resource
ingressClassDefaultAnnotation = "ingressclass.kubernetes.io/is-default-class" // we do not support this https://kubernetes.io/docs/concepts/services-networking/ingress/#default-ingress-class
indexIngressProxyClass = ".metadata.annotations.ingress-proxy-class"
)
type IngressReconciler struct {

124
cmd/k8s-operator/ingress_test.go
View File

@ -230,7 +230,8 @@ func TestTailscaleIngressWithProxyClass(t *testing.T) {
Spec: tsapi.ProxyClassSpec{StatefulSet: &tsapi.StatefulSet{
Labels: tsapi.Labels{"foo": "bar"},
Annotations: map[string]string{"bar.io/foo": "some-val"},
Pod: &tsapi.Pod{Annotations: map[string]string{"foo.io/bar": "some-val"}}}},
Pod: &tsapi.Pod{Annotations: map[string]string{"foo.io/bar": "some-val"}},
}},
}
fc := fake.NewClientBuilder().
WithScheme(tsapi.GlobalScheme).
@ -285,7 +286,7 @@ func TestTailscaleIngressWithProxyClass(t *testing.T) {
// 2. Ingress is updated to specify a ProxyClass, ProxyClass is not yet
// ready, so proxy resource configuration does not change.
mustUpdate(t, fc, "default", "test", func(ing *networkingv1.Ingress) {
mak.Set(&ing.ObjectMeta.Labels, LabelProxyClass, "custom-metadata")
mak.Set(&ing.ObjectMeta.Labels, LabelAnnotationProxyClass, "custom-metadata")
})
expectReconciled(t, ingR, "default", "test")
expectEqual(t, fc, expectedSTSUserspace(t, fc, opts), removeResourceReqs)
@ -299,7 +300,8 @@ func TestTailscaleIngressWithProxyClass(t *testing.T) {
Status: metav1.ConditionTrue,
Type: string(tsapi.ProxyClassReady),
ObservedGeneration: pc.Generation,
}}}
}},
}
})
expectReconciled(t, ingR, "default", "test")
opts.proxyClass = pc.Name
@ -309,7 +311,7 @@ func TestTailscaleIngressWithProxyClass(t *testing.T) {
// Ingress gets reconciled and the custom ProxyClass configuration is
// removed from the proxy resources.
mustUpdate(t, fc, "default", "test", func(ing *networkingv1.Ingress) {
delete(ing.ObjectMeta.Labels, LabelProxyClass)
delete(ing.ObjectMeta.Labels, LabelAnnotationProxyClass)
})
expectReconciled(t, ingR, "default", "test")
opts.proxyClass = ""
@ -325,14 +327,15 @@ func TestTailscaleIngressWithServiceMonitor(t *testing.T) {
Status: metav1.ConditionTrue,
Type: string(tsapi.ProxyClassReady),
ObservedGeneration: 1,
}}},
}},
},
}
crd := &apiextensionsv1.CustomResourceDefinition{ObjectMeta: metav1.ObjectMeta{Name: serviceMonitorCRD}}
// Create fake client with ProxyClass, IngressClass, Ingress with metrics ProxyClass, and Service
ing := ingress()
ing.Labels = map[string]string{
LabelProxyClass: "metrics",
LabelAnnotationProxyClass: "metrics",
}
fc := fake.NewClientBuilder().
WithScheme(tsapi.GlobalScheme).
@ -421,6 +424,113 @@ func TestTailscaleIngressWithServiceMonitor(t *testing.T) {
// ServiceMonitor gets garbage collected when the Service is deleted - we cannot test that here.
}
func TestIngressProxyClassAnnotation(t *testing.T) {
cl := tstest.NewClock(tstest.ClockOpts{})
zl := zap.Must(zap.NewDevelopment())
pcLEStaging, pcLEStagingFalse, _ := proxyClassesForLEStagingTest()
testCases := []struct {
name string
proxyClassAnnotation string
proxyClassLabel string
proxyClassDefault string
expectedProxyClass string
expectEvents []string
}{
{
name: "via_label",
proxyClassLabel: pcLEStaging.Name,
expectedProxyClass: pcLEStaging.Name,
},
{
name: "via_annotation",
proxyClassAnnotation: pcLEStaging.Name,
expectedProxyClass: pcLEStaging.Name,
},
{
name: "via_default",
proxyClassDefault: pcLEStaging.Name,
expectedProxyClass: pcLEStaging.Name,
},
{
name: "via_label_override_annotation",
proxyClassLabel: pcLEStaging.Name,
proxyClassAnnotation: pcLEStagingFalse.Name,
expectedProxyClass: pcLEStaging.Name,
},
}
for _, tt := range testCases {
t.Run(tt.name, func(t *testing.T) {
builder := fake.NewClientBuilder().
WithScheme(tsapi.GlobalScheme)
builder = builder.WithObjects(pcLEStaging, pcLEStagingFalse).
WithStatusSubresource(pcLEStaging, pcLEStagingFalse)
fc := builder.Build()
if tt.proxyClassAnnotation != "" || tt.proxyClassLabel != "" || tt.proxyClassDefault != "" {
name := tt.proxyClassDefault
if name == "" {
name = tt.proxyClassLabel
if name == "" {
name = tt.proxyClassAnnotation
}
}
setProxyClassReady(t, fc, cl, name)
}
mustCreate(t, fc, ingressClass())
mustCreate(t, fc, service())
ing := ingress()
if tt.proxyClassLabel != "" {
ing.Labels = map[string]string{
LabelAnnotationProxyClass: tt.proxyClassLabel,
}
}
if tt.proxyClassAnnotation != "" {
ing.Annotations = map[string]string{
LabelAnnotationProxyClass: tt.proxyClassAnnotation,
}
}
mustCreate(t, fc, ing)
ingR := &IngressReconciler{
Client: fc,
ssr: &tailscaleSTSReconciler{
Client: fc,
tsClient: &fakeTSClient{},
tsnetServer: &fakeTSNetServer{certDomains: []string{"test-host"}},
defaultTags: []string{"tag:test"},
operatorNamespace: "operator-ns",
proxyImage: "tailscale/tailscale:test",
},
logger: zl.Sugar(),
defaultProxyClass: tt.proxyClassDefault,
}
expectReconciled(t, ingR, "default", "test")
_, shortName := findGenName(t, fc, "default", "test", "ingress")
sts := &appsv1.StatefulSet{}
if err := fc.Get(context.Background(), client.ObjectKey{Namespace: "operator-ns", Name: shortName}, sts); err != nil {
t.Fatalf("failed to get StatefulSet: %v", err)
}
switch tt.expectedProxyClass {
case pcLEStaging.Name:
verifyEnvVar(t, sts, "TS_DEBUG_ACME_DIRECTORY_URL", letsEncryptStagingEndpoint)
case pcLEStagingFalse.Name:
verifyEnvVarNotPresent(t, sts, "TS_DEBUG_ACME_DIRECTORY_URL")
default:
t.Fatalf("unexpected expected ProxyClass %q", tt.expectedProxyClass)
}
})
}
}
func TestIngressLetsEncryptStaging(t *testing.T) {
cl := tstest.NewClock(tstest.ClockOpts{})
zl := zap.Must(zap.NewDevelopment())
@ -452,7 +562,7 @@ func TestIngressLetsEncryptStaging(t *testing.T) {
ing := ingress()
if tt.proxyClassPerResource != "" {
ing.Labels = map[string]string{
LabelProxyClass: tt.proxyClassPerResource,
LabelAnnotationProxyClass: tt.proxyClassPerResource,
}
}
mustCreate(t, fc, ing)

69
cmd/k8s-operator/operator.go
View File

@ -54,6 +54,7 @@ import (
"tailscale.com/tsnet"
"tailscale.com/tstime"
"tailscale.com/types/logger"
"tailscale.com/util/set"
"tailscale.com/version"
)
@ -307,6 +308,7 @@ func runReconcilers(opts reconcilerOpts) {
proxyPriorityClassName: opts.proxyPriorityClassName,
tsFirewallMode: opts.proxyFirewallMode,
}
err = builder.
ControllerManagedBy(mgr).
Named("service-reconciler").
@ -327,6 +329,10 @@ func runReconcilers(opts reconcilerOpts) {
if err != nil {
startlog.Fatalf("could not create service reconciler: %v", err)
}
if err := mgr.GetFieldIndexer().IndexField(context.Background(), new(corev1.Service), indexServiceProxyClass, indexProxyClass); err != nil {
startlog.Fatalf("failed setting up ProxyClass indexer for Services: %v", err)
}
ingressChildFilter := handler.EnqueueRequestsFromMapFunc(managedResourceHandlerForType("ingress"))
// If a ProxyClassChanges, enqueue all Ingresses labeled with that
// ProxyClass's name.
@ -351,6 +357,10 @@ func runReconcilers(opts reconcilerOpts) {
if err != nil {
startlog.Fatalf("could not create ingress reconciler: %v", err)
}
if err := mgr.GetFieldIndexer().IndexField(context.Background(), new(networkingv1.Ingress), indexIngressProxyClass, indexProxyClass); err != nil {
startlog.Fatalf("failed setting up ProxyClass indexer for Ingresses: %v", err)
}
lc, err := opts.tsServer.LocalClient()
if err != nil {
startlog.Fatalf("could not get local client: %v", err)
@ -797,6 +807,16 @@ func managedResourceHandlerForType(typ string) handler.MapFunc {
}
}
// indexProxyClass is used to select ProxyClass-backed objects which are
// locally indexed in the cache for efficient listing without requiring labels.
func indexProxyClass(o client.Object) []string {
if !hasProxyClassAnnotation(o) {
return nil
}
return []string{o.GetAnnotations()[LabelAnnotationProxyClass]}
}
// proxyClassHandlerForSvc returns a handler that, for a given ProxyClass,
// returns a list of reconcile requests for all Services labeled with
// tailscale.com/proxy-class: <proxy class name>.
@ -804,16 +824,37 @@ func proxyClassHandlerForSvc(cl client.Client, logger *zap.SugaredLogger) handle
return func(ctx context.Context, o client.Object) []reconcile.Request {
svcList := new(corev1.ServiceList)
labels := map[string]string{
LabelProxyClass: o.GetName(),
LabelAnnotationProxyClass: o.GetName(),
}
if err := cl.List(ctx, svcList, client.MatchingLabels(labels)); err != nil {
logger.Debugf("error listing Services for ProxyClass: %v", err)
return nil
}
reqs := make([]reconcile.Request, 0)
seenSvcs := make(set.Set[string])
for _, svc := range svcList.Items {
reqs = append(reqs, reconcile.Request{NamespacedName: client.ObjectKeyFromObject(&svc)})
seenSvcs.Add(fmt.Sprintf("%s/%s", svc.Namespace, svc.Name))
}
svcAnnotationList := new(corev1.ServiceList)
if err := cl.List(ctx, svcAnnotationList, client.MatchingFields{indexServiceProxyClass: o.GetName()}); err != nil {
logger.Debugf("error listing Services for ProxyClass: %v", err)
return nil
}
for _, svc := range svcAnnotationList.Items {
nsname := fmt.Sprintf("%s/%s", svc.Namespace, svc.Name)
if seenSvcs.Contains(nsname) {
continue
}
reqs = append(reqs, reconcile.Request{NamespacedName: client.ObjectKeyFromObject(&svc)})
seenSvcs.Add(nsname)
}
return reqs
}
}
@ -825,16 +866,36 @@ func proxyClassHandlerForIngress(cl client.Client, logger *zap.SugaredLogger) ha
return func(ctx context.Context, o client.Object) []reconcile.Request {
ingList := new(networkingv1.IngressList)
labels := map[string]string{
LabelProxyClass: o.GetName(),
LabelAnnotationProxyClass: o.GetName(),
}
if err := cl.List(ctx, ingList, client.MatchingLabels(labels)); err != nil {
logger.Debugf("error listing Ingresses for ProxyClass: %v", err)
return nil
}
reqs := make([]reconcile.Request, 0)
seenIngs := make(set.Set[string])
for _, ing := range ingList.Items {
reqs = append(reqs, reconcile.Request{NamespacedName: client.ObjectKeyFromObject(&ing)})
seenIngs.Add(fmt.Sprintf("%s/%s", ing.Namespace, ing.Name))
}
ingAnnotationList := new(networkingv1.IngressList)
if err := cl.List(ctx, ingAnnotationList, client.MatchingFields{indexIngressProxyClass: o.GetName()}); err != nil {
logger.Debugf("error listing Ingreses for ProxyClass: %v", err)
return nil
}
for _, ing := range ingAnnotationList.Items {
nsname := fmt.Sprintf("%s/%s", ing.Namespace, ing.Name)
if seenIngs.Contains(nsname) {
continue
}
reqs = append(reqs, reconcile.Request{NamespacedName: client.ObjectKeyFromObject(&ing)})
seenIngs.Add(nsname)
}
return reqs
}
}
@ -1500,6 +1561,10 @@ func hasProxyGroupAnnotation(obj client.Object) bool {
return obj.GetAnnotations()[AnnotationProxyGroup] != ""
}
func hasProxyClassAnnotation(obj client.Object) bool {
return obj.GetAnnotations()[LabelAnnotationProxyClass] != ""
}
func id(ctx context.Context, lc *local.Client) (string, error) {
st, err := lc.StatusWithoutPeers(ctx)
if err != nil {

202
cmd/k8s-operator/operator_test.go
View File

@ -7,6 +7,7 @@ package main
import (
"context"
"encoding/json"
"fmt"
"testing"
"time"
@ -20,8 +21,10 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"
"k8s.io/client-go/tools/record"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/client/fake"
"sigs.k8s.io/controller-runtime/pkg/reconcile"
"tailscale.com/k8s-operator/apis/v1alpha1"
tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
"tailscale.com/kube/kubetypes"
"tailscale.com/net/dns/resolvconffile"
@ -1121,6 +1124,182 @@ func TestCustomPriorityClassName(t *testing.T) {
expectEqual(t, fc, expectedSTS(t, fc, o), removeResourceReqs)
}
func TestServiceProxyClassAnnotation(t *testing.T) {
cl := tstest.NewClock(tstest.ClockOpts{})
zl := zap.Must(zap.NewDevelopment())
pcIfNotPresent := &tsapi.ProxyClass{
ObjectMeta: metav1.ObjectMeta{
Name: "if-not-present",
},
Spec: tsapi.ProxyClassSpec{
StatefulSet: &tsapi.StatefulSet{
Pod: &tsapi.Pod{
TailscaleContainer: &v1alpha1.Container{
ImagePullPolicy: corev1.PullIfNotPresent,
},
},
},
},
}
pcAlways := &tsapi.ProxyClass{
ObjectMeta: metav1.ObjectMeta{
Name: "always",
},
Spec: tsapi.ProxyClassSpec{
StatefulSet: &tsapi.StatefulSet{
Pod: &tsapi.Pod{
TailscaleContainer: &v1alpha1.Container{
ImagePullPolicy: corev1.PullAlways,
},
},
},
},
}
builder := fake.NewClientBuilder().
WithScheme(tsapi.GlobalScheme)
builder = builder.WithObjects(pcIfNotPresent, pcAlways).
WithStatusSubresource(pcIfNotPresent, pcAlways)
fc := builder.Build()
svc := &corev1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: "test",
Namespace: "default",
// The apiserver is supposed to set the UID, but the fake client
// doesn't. So, set it explicitly because other code later depends
// on it being set.
UID: types.UID("1234-UID"),
},
Spec: corev1.ServiceSpec{
ClusterIP: "10.20.30.40",
Type: corev1.ServiceTypeLoadBalancer,
},
}
mustCreate(t, fc, svc)
testCases := []struct {
name string
proxyClassAnnotation string
proxyClassLabel string
proxyClassDefault string
expectedProxyClass string
expectEvents []string
}{
{
name: "via_label",
proxyClassLabel: pcIfNotPresent.Name,
expectedProxyClass: pcIfNotPresent.Name,
},
{
name: "via_annotation",
proxyClassAnnotation: pcIfNotPresent.Name,
expectedProxyClass: pcIfNotPresent.Name,
},
{
name: "via_default",
proxyClassDefault: pcIfNotPresent.Name,
expectedProxyClass: pcIfNotPresent.Name,
},
{
name: "via_label_override_annotation",
proxyClassLabel: pcIfNotPresent.Name,
proxyClassAnnotation: pcAlways.Name,
expectedProxyClass: pcIfNotPresent.Name,
},
}
for _, tt := range testCases {
t.Run(tt.name, func(t *testing.T) {
ft := &fakeTSClient{}
if tt.proxyClassAnnotation != "" || tt.proxyClassLabel != "" || tt.proxyClassDefault != "" {
name := tt.proxyClassDefault
if name == "" {
name = tt.proxyClassLabel
if name == "" {
name = tt.proxyClassAnnotation
}
}
setProxyClassReady(t, fc, cl, name)
}
sr := &ServiceReconciler{
Client: fc,
ssr: &tailscaleSTSReconciler{
Client: fc,
tsClient: ft,
defaultTags: []string{"tag:k8s"},
operatorNamespace: "operator-ns",
proxyImage: "tailscale/tailscale",
},
defaultProxyClass: tt.proxyClassDefault,
logger: zl.Sugar(),
clock: cl,
isDefaultLoadBalancer: true,
}
if tt.proxyClassLabel != "" {
svc.Labels = map[string]string{
LabelAnnotationProxyClass: tt.proxyClassLabel,
}
}
if tt.proxyClassAnnotation != "" {
svc.Annotations = map[string]string{
LabelAnnotationProxyClass: tt.proxyClassAnnotation,
}
}
mustUpdate(t, fc, svc.Namespace, svc.Name, func(s *corev1.Service) {
s.Labels = svc.Labels
s.Annotations = svc.Annotations
})
expectReconciled(t, sr, "default", "test")
list := &corev1.ServiceList{}
fc.List(context.Background(), list, client.InNamespace("default"))
for _, i := range list.Items {
t.Logf("found service %s", i.Name)
}
slist := &corev1.SecretList{}
fc.List(context.Background(), slist, client.InNamespace("operator-ns"))
for _, i := range slist.Items {
l, _ := json.Marshal(i.Labels)
t.Logf("found secret %q with labels %q ", i.Name, string(l))
}
_, shortName := findGenName(t, fc, "default", "test", "svc")
sts := &appsv1.StatefulSet{}
if err := fc.Get(context.Background(), client.ObjectKey{Namespace: "operator-ns", Name: shortName}, sts); err != nil {
t.Fatalf("failed to get StatefulSet: %v", err)
}
switch tt.expectedProxyClass {
case pcIfNotPresent.Name:
for _, cont := range sts.Spec.Template.Spec.Containers {
if cont.Name == "tailscale" && cont.ImagePullPolicy != corev1.PullIfNotPresent {
t.Fatalf("ImagePullPolicy %q does not match ProxyClass %q with value %q", cont.ImagePullPolicy, pcIfNotPresent.Name, pcIfNotPresent.Spec.StatefulSet.Pod.TailscaleContainer.ImagePullPolicy)
}
}
case pcAlways.Name:
for _, cont := range sts.Spec.Template.Spec.Containers {
if cont.Name == "tailscale" && cont.ImagePullPolicy != corev1.PullAlways {
t.Fatalf("ImagePullPolicy %q does not match ProxyClass %q with value %q", cont.ImagePullPolicy, pcAlways.Name, pcAlways.Spec.StatefulSet.Pod.TailscaleContainer.ImagePullPolicy)
}
}
default:
t.Fatalf("unexpected expected ProxyClass %q", tt.expectedProxyClass)
}
})
}
}
func TestProxyClassForService(t *testing.T) {
// Setup
pc := &tsapi.ProxyClass{
@ -1132,7 +1311,9 @@ func TestProxyClassForService(t *testing.T) {
StatefulSet: &tsapi.StatefulSet{
Labels: tsapi.Labels{"foo": "bar"},
Annotations: map[string]string{"bar.io/foo": "some-val"},
Pod: &tsapi.Pod{Annotations: map[string]string{"foo.io/bar": "some-val"}}}},
Pod: &tsapi.Pod{Annotations: map[string]string{"foo.io/bar": "some-val"}},
},
},
}
fc := fake.NewClientBuilder().
WithScheme(tsapi.GlobalScheme).
@ -1194,7 +1375,7 @@ func TestProxyClassForService(t *testing.T) {
// pointing at the 'custom-metadata' ProxyClass. The ProxyClass is not
// yet ready, so no changes are actually applied to the proxy resources.
mustUpdate(t, fc, "default", "test", func(svc *corev1.Service) {
mak.Set(&svc.Labels, LabelProxyClass, "custom-metadata")
mak.Set(&svc.Labels, LabelAnnotationProxyClass, "custom-metadata")
})
expectReconciled(t, sr, "default", "test")
expectEqual(t, fc, expectedSTS(t, fc, opts), removeResourceReqs)
@ -1209,7 +1390,8 @@ func TestProxyClassForService(t *testing.T) {
Status: metav1.ConditionTrue,
Type: string(tsapi.ProxyClassReady),
ObservedGeneration: pc.Generation,
}}}
}},
}
})
opts.proxyClass = pc.Name
expectReconciled(t, sr, "default", "test")
@ -1220,7 +1402,7 @@ func TestProxyClassForService(t *testing.T) {
// configuration from the ProxyClass is removed from the cluster
// resources.
mustUpdate(t, fc, "default", "test", func(svc *corev1.Service) {
delete(svc.Labels, LabelProxyClass)
delete(svc.Labels, LabelAnnotationProxyClass)
})
opts.proxyClass = ""
expectReconciled(t, sr, "default", "test")
@ -1439,7 +1621,8 @@ func Test_serviceHandlerForIngress(t *testing.T) {
IngressClassName: ptr.To(tailscaleIngressClassName),
Rules: []networkingv1.IngressRule{{IngressRuleValue: networkingv1.IngressRuleValue{HTTP: &networkingv1.HTTPIngressRuleValue{
Paths: []networkingv1.HTTPIngressPath{
{Backend: networkingv1.IngressBackend{Service: &networkingv1.IngressServiceBackend{Name: "backend"}}}},
{Backend: networkingv1.IngressBackend{Service: &networkingv1.IngressServiceBackend{Name: "backend"}}},
},
}}}},
},
})
@ -1466,7 +1649,8 @@ func Test_serviceHandlerForIngress(t *testing.T) {
Spec: networkingv1.IngressSpec{
Rules: []networkingv1.IngressRule{{IngressRuleValue: networkingv1.IngressRuleValue{HTTP: &networkingv1.HTTPIngressRuleValue{
Paths: []networkingv1.HTTPIngressPath{
{Backend: networkingv1.IngressBackend{Service: &networkingv1.IngressServiceBackend{Name: "non-ts-backend"}}}},
{Backend: networkingv1.IngressBackend{Service: &networkingv1.IngressServiceBackend{Name: "non-ts-backend"}}},
},
}}}},
},
})
@ -1565,6 +1749,7 @@ func Test_clusterDomainFromResolverConf(t *testing.T) {
})
}
}
func Test_authKeyRemoval(t *testing.T) {
fc := fake.NewFakeClient()
ft := &fakeTSClient{}
@ -1711,14 +1896,15 @@ func Test_metricsResourceCreation(t *testing.T) {
Status: metav1.ConditionTrue,
Type: string(tsapi.ProxyClassReady),
ObservedGeneration: 1,
}}},
}},
},
}
svc := &corev1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: "test",
Namespace: "default",
UID: types.UID("1234-UID"),
Labels: map[string]string{LabelProxyClass: "metrics"},
Labels: map[string]string{LabelAnnotationProxyClass: "metrics"},
},
Spec: corev1.ServiceSpec{
ClusterIP: "10.20.30.40",

18
cmd/k8s-operator/sts.go
View File

@ -50,7 +50,7 @@ const (
// LabelProxyClass can be set by users on tailscale Ingresses and Services that define cluster ingress or
// cluster egress, to specify that configuration in this ProxyClass should be applied to resources created for
// the Ingress or Service.
LabelProxyClass = "tailscale.com/proxy-class"
LabelAnnotationProxyClass = "tailscale.com/proxy-class"
FinalizerName = "tailscale.com/finalizer"
@ -1127,6 +1127,22 @@ func nameForService(svc *corev1.Service) string {
return svc.Namespace + "-" + svc.Name
}
// proxyClassForObject returns the proxy class for the given object. If the
// object does not have a proxy class label, it returns the default proxy class
func proxyClassForObject(o client.Object, proxyDefaultClass string) string {
proxyClass, exists := o.GetLabels()[LabelAnnotationProxyClass]
if exists {
return proxyClass
}
proxyClass, exists = o.GetAnnotations()[LabelAnnotationProxyClass]
if exists {
return proxyClass
}
return proxyDefaultClass
}
func isValidFirewallMode(m string) bool {
return m == "auto" || m == "nftables" || m == "iptables"
}

12
cmd/k8s-operator/svc.go
View File

@ -41,6 +41,8 @@ const (
reasonProxyInvalid = "ProxyInvalid"
reasonProxyFailed = "ProxyFailed"
reasonProxyPending = "ProxyPending"
indexServiceProxyClass = ".metadata.annotations.service-proxy-class"
)
type ServiceReconciler struct {
@ -438,16 +440,6 @@ func tailnetTargetAnnotation(svc *corev1.Service) string {
return svc.Annotations[annotationTailnetTargetIPOld]
}
// proxyClassForObject returns the proxy class for the given object. If the
// object does not have a proxy class label, it returns the default proxy class
func proxyClassForObject(o client.Object, proxyDefaultClass string) string {
proxyClass, exists := o.GetLabels()[LabelProxyClass]
if !exists {
proxyClass = proxyDefaultClass
}
return proxyClass
}
func proxyClassIsReady(ctx context.Context, name string, cl client.Client) (bool, error) {
proxyClass := new(tsapi.ProxyClass)
if err := cl.Get(ctx, types.NamespacedName{Name: name}, proxyClass); err != nil {