TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-08-14 06:57:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services (#15897)

Browse Source 
cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services

This PR is part of the work to implement HA for Kubernetes Operator's
network layer proxy.
Adds logic to containerboot to monitor mounted ingress firewall configuration rules
and update iptables/nftables rules as the config changes.
Also adds new shared types for the ingress configuration.
The implementation is intentionally similar to that for HA for egress proxy.

Updates tailscale/tailscale#15895

Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
Signed-off-by: Irbe Krumina <irbe@tailscale.com>
This commit is contained in:
Irbe Krumina
2025-05-19 10:42:03 +01:00
committed by GitHub
parent 469fabd8de
commit 6b97e615d6
10 changed files with 1456 additions and 804 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
util/linuxfw/fake_netfilter.go
View File

@@ -16,8 +16,8 @@ type FakeNetfilterRunner struct {
// services is a map that tracks the firewall rules added/deleted via
// EnsureDNATRuleForSvc/DeleteDNATRuleForSvc.
services map[string]struct {
VIPServiceIP netip.Addr
ClusterIP netip.Addr
TailscaleServiceIP netip.Addr
ClusterIP netip.Addr
}
}
@@ -25,16 +25,16 @@ type FakeNetfilterRunner struct {
func NewFakeNetfilterRunner() *FakeNetfilterRunner {
return &FakeNetfilterRunner{
services: make(map[string]struct {
VIPServiceIP netip.Addr
ClusterIP netip.Addr
TailscaleServiceIP netip.Addr
ClusterIP netip.Addr
}),
}
}
func (f *FakeNetfilterRunner) EnsureDNATRuleForSvc(svcName string, origDst, dst netip.Addr) error {
f.services[svcName] = struct {
VIPServiceIP netip.Addr
ClusterIP netip.Addr
TailscaleServiceIP netip.Addr
ClusterIP netip.Addr
}{origDst, dst}
return nil
}
@@ -45,8 +45,8 @@ func (f *FakeNetfilterRunner) DeleteDNATRuleForSvc(svcName string, origDst, dst
}
func (f *FakeNetfilterRunner) GetServiceState() map[string]struct {
VIPServiceIP netip.Addr
ClusterIP netip.Addr
TailscaleServiceIP netip.Addr
ClusterIP netip.Addr
} {
return f.services
}