TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-08-01 00:33:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

cmd/containerboot: fix nil pointer exception (cherry-pick of #14357, #14358) (#14359)

Browse Source 
* cmd/containerboot: guard kubeClient against nil dereference (#14357)

A method on kc was called unconditionally, even if was not initialized,
leading to a nil pointer dereference when TS_SERVE_CONFIG was set
outside Kubernetes.

Add a guard symmetric with other uses of the kubeClient.

Signed-off-by: Bjorn Neergaard <bjorn@neersighted.com>
(cherry picked from commit 8b1d01161bbca8a26c2a50208444087c9fa2b3f1)

* cmd/containerboot: don't attempt to write kube Secret in non-kube environments (#14358)

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
(cherry picked from commit 0cc071f15409071f2649c3e142eceaf7cabff560)

* cmd/containerboot: don't attempt to patch a Secret field without permissions (#14365)

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
(cherry picked from commit 6e552f66a0289f6309477fb024019b62a251da16)

Updates tailscale/tailscale#14354
This commit is contained in:
Irbe Krumina 2024-12-11 15:30:43 +00:00 committed by GitHub
parent 3e3d5d8c68
commit 6e0f168db0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cmd/containerboot/kube.go
View File

@ -24,6 +24,7 @@ import (
type kubeClient struct {
kubeclient.Client
stateSecret string
canPatch bool // whether the client has permissions to patch Kubernetes Secrets
}
func newKubeClient(root string, stateSecret string) (*kubeClient, error) {

6
cmd/containerboot/main.go
View File

@ -331,8 +331,10 @@ authLoop:
if err := client.SetServeConfig(ctx, new(ipn.ServeConfig)); err != nil {
log.Fatalf("failed to unset serve config: %v", err)
}
if err := kc.storeHTTPSEndpoint(ctx, ""); err != nil {
log.Fatalf("failed to update HTTPS endpoint in tailscale state: %v", err)
if hasKubeStateStore(cfg) {
if err := kc.storeHTTPSEndpoint(ctx, ""); err != nil {
log.Fatalf("failed to update HTTPS endpoint in tailscale state: %v", err)
}
}
}

6
cmd/containerboot/serve.go
View File

@ -72,8 +72,10 @@ func watchServeConfigChanges(ctx context.Context, path string, cdChanged <-chan
if err := updateServeConfig(ctx, sc, certDomain, lc); err != nil {
log.Fatalf("serve proxy: error updating serve config: %v", err)
}
if err := kc.storeHTTPSEndpoint(ctx, certDomain); err != nil {
log.Fatalf("serve proxy: error storing HTTPS endpoint: %v", err)
if kc != nil && kc.canPatch {
if err := kc.storeHTTPSEndpoint(ctx, certDomain); err != nil {
log.Fatalf("serve proxy: error storing HTTPS endpoint: %v", err)
}
}
prevServeConfig = sc
}

1
cmd/containerboot/settings.go
View File

@ -214,6 +214,7 @@ func (cfg *settings) setupKube(ctx context.Context, kc *kubeClient) error {
return fmt.Errorf("some Kubernetes permissions are missing, please check your RBAC configuration: %v", err)
}
cfg.KubernetesCanPatch = canPatch
kc.canPatch = canPatch
s, err := kc.GetSecret(ctx, cfg.KubeSecret)
if err != nil {