cmd/{k8s-operator,containerboot},k8s-operator,kube: reconcile ExternalName Services for ProxyGroup (#13635)

Adds a new reconciler that reconciles ExternalName Services that define a
tailnet target that should be exposed to cluster workloads on a ProxyGroup's
proxies.
The reconciler ensures that for each such service, the config mounted to
the proxies is updated with the tailnet target definition and that
and EndpointSlice and ClusterIP Service are created for the service.

Adds a new reconciler that ensures that as proxy Pods become ready to route
traffic to a tailnet target, the EndpointSlice for the target is updated
with the Pods' endpoints.

Updates tailscale/tailscale#13406

Signed-off-by: Irbe Krumina <irbe@tailscale.com>

k8s-operator/apis/v1alpha1/register.go

@@ -58,6 +58,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&DNSConfigList{},
 		&Recorder{},
 		&RecorderList{},
+		&ProxyGroup{},
+		&ProxyGroupList{},
 	)
 
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)

k8s-operator/apis/v1alpha1/types_connector.go

@@ -172,6 +172,14 @@ type ConditionType string
 const (
 	ConnectorReady  ConditionType = `ConnectorReady`
 	ProxyClassready ConditionType = `ProxyClassReady`
+	ProxyGroupReady ConditionType = `ProxyGroupReady`
 	ProxyReady      ConditionType = `TailscaleProxyReady` // a Tailscale-specific condition type for corev1.Service
 	RecorderReady   ConditionType = `RecorderReady`
+	// EgressSvcValid is set to true if the user configured ExternalName Service for exposing a tailnet target on
+	// ProxyGroup nodes is valid.
+	EgressSvcValid ConditionType = `EgressSvcValid`
+	// EgressSvcConfigured is set to true if the configuration for the egress Service (proxy ConfigMap update,
+	// EndpointSlice for the Service) has been successfully applied. The Reason for this condition
+	// contains the name of the ProxyGroup and the hash of the Service ports and the tailnet target.
+	EgressSvcConfigured ConditionType = `EgressSvcConfigured`
 )

k8s-operator/apis/v1alpha1/types_proxygroup.go

@@ -40,7 +40,7 @@ type ProxyGroupSpec struct {
 	// Type of the ProxyGroup, either ingress or egress. Each set of proxies
 	// managed by a single ProxyGroup definition operate as only ingress or
 	// only egress proxies.
-	Type ProxyClassType `json:"type"`
+	Type ProxyGroupType `json:"type"`
 
 	// Tags that the Tailscale devices will be tagged with. Defaults to [tag:k8s].
 	// If you specify custom tags here, make sure you also make the operator
@@ -101,10 +101,10 @@ type TailnetDevice struct {
 
 // +kubebuilder:validation:Type=string
 // +kubebuilder:validation:Enum=egress
-type ProxyClassType string
+type ProxyGroupType string
 
 const (
-	ProxyClassTypeEgress ProxyClassType = "egress"
+	ProxyGroupTypeEgress ProxyGroupType = "egress"
 )
 
 // +kubebuilder:validation:Type=string