TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-07-18 19:48:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

cmd/k8s-operator: allow letsencrypt staging on k8s proxies (#16521)

Browse Source 
This commit modifies the operator to detect the usage of k8s-apiserver
type proxy groups that wish to use the letsencrypt staging directory and
apply the appropriate environment variable to the statefulset it
produces.

Updates #13358

Signed-off-by: David Bond <davidsbond93@gmail.com>
This commit is contained in:
David Bond 2025-07-10 14:33:13 +01:00 committed by GitHub
parent fbc4c34cf7
commit cf0460b9da
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 20 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
cmd/k8s-operator/sts.go
View File

@ -761,14 +761,21 @@ func applyProxyClassToStatefulSet(pc *tsapi.ProxyClass, ss *appsv1.StatefulSet,
enableEndpoints(ss, metricsEnabled, debugEnabled) enableEndpoints(ss, metricsEnabled, debugEnabled)
} }
} }
if pc.Spec.UseLetsEncryptStagingEnvironment && (stsCfg.proxyType == proxyTypeIngressResource || stsCfg.proxyType == string(tsapi.ProxyGroupTypeIngress)) {
for i, c := range ss.Spec.Template.Spec.Containers { if stsCfg != nil {
if isMainContainer(&c) { usesLetsEncrypt := stsCfg.proxyType == proxyTypeIngressResource ||
ss.Spec.Template.Spec.Containers[i].Env = append(ss.Spec.Template.Spec.Containers[i].Env, corev1.EnvVar{ stsCfg.proxyType == string(tsapi.ProxyGroupTypeIngress) ||
Name: "TS_DEBUG_ACME_DIRECTORY_URL", stsCfg.proxyType == string(tsapi.ProxyGroupTypeKubernetesAPIServer)
Value: letsEncryptStagingEndpoint,
}) if pc.Spec.UseLetsEncryptStagingEnvironment && usesLetsEncrypt {
break for i, c := range ss.Spec.Template.Spec.Containers {
if isMainContainer(&c) {
ss.Spec.Template.Spec.Containers[i].Env = append(ss.Spec.Template.Spec.Containers[i].Env, corev1.EnvVar{
Name: "TS_DEBUG_ACME_DIRECTORY_URL",
Value: letsEncryptStagingEndpoint,
})
break
}
} }
} }
} }

5
cmd/k8s-operator/sts_test.go
View File

@ -61,6 +61,7 @@ func Test_applyProxyClassToStatefulSet(t *testing.T) {
// Setup // Setup
proxyClassAllOpts := &tsapi.ProxyClass{ proxyClassAllOpts := &tsapi.ProxyClass{
Spec: tsapi.ProxyClassSpec{ Spec: tsapi.ProxyClassSpec{
UseLetsEncryptStagingEnvironment: true,
StatefulSet: &tsapi.StatefulSet{ StatefulSet: &tsapi.StatefulSet{
Labels: tsapi.Labels{"foo": "bar"}, Labels: tsapi.Labels{"foo": "bar"},
Annotations: map[string]string{"foo.io/bar": "foo"}, Annotations: map[string]string{"foo.io/bar": "foo"},
@ -292,6 +293,10 @@ func Test_applyProxyClassToStatefulSet(t *testing.T) {
if diff := cmp.Diff(gotSS, wantSS); diff != "" { if diff := cmp.Diff(gotSS, wantSS); diff != "" {
t.Errorf("Unexpected result applying ProxyClass with metrics enabled to a StatefulSet (-got +want):\n%s", diff) t.Errorf("Unexpected result applying ProxyClass with metrics enabled to a StatefulSet (-got +want):\n%s", diff)
} }
// 8. A Kubernetes API proxy with letsencrypt staging enabled
gotSS = applyProxyClassToStatefulSet(proxyClassAllOpts, nonUserspaceProxySS.DeepCopy(), &tailscaleSTSConfig{proxyType: string(tsapi.ProxyGroupTypeKubernetesAPIServer)}, zl.Sugar())
verifyEnvVar(t, gotSS, "TS_DEBUG_ACME_DIRECTORY_URL", letsEncryptStagingEndpoint)
} }
func Test_mergeStatefulSetLabelsOrAnnots(t *testing.T) { func Test_mergeStatefulSetLabelsOrAnnots(t *testing.T) {