cmd/{k8s-operator,containerboot},k8s-operator,kube: reconcile ExternalName Services for ProxyGroup (#13635)

Adds a new reconciler that reconciles ExternalName Services that define a
tailnet target that should be exposed to cluster workloads on a ProxyGroup's
proxies.
The reconciler ensures that for each such service, the config mounted to
the proxies is updated with the tailnet target definition and that
and EndpointSlice and ClusterIP Service are created for the service.

Adds a new reconciler that ensures that as proxy Pods become ready to route
traffic to a tailnet target, the EndpointSlice for the target is updated
with the Pods' endpoints.

Updates tailscale/tailscale#13406

Signed-off-by: Irbe Krumina <irbe@tailscale.com>

k8s-operator/conditions.go

@@ -56,6 +56,18 @@ func SetServiceCondition(svc *corev1.Service, conditionType tsapi.ConditionType,
 	svc.Status.Conditions = conds
 }
 
+// GetServiceCondition returns Service condition with the specified type, if it exists on the Service.
+func GetServiceCondition(svc *corev1.Service, conditionType tsapi.ConditionType) *metav1.Condition {
+	idx := xslices.IndexFunc(svc.Status.Conditions, func(cond metav1.Condition) bool {
+		return cond.Type == string(conditionType)
+	})
+
+	if idx == -1 {
+		return nil
+	}
+	return &svc.Status.Conditions[idx]
+}
+
 // RemoveServiceCondition will remove condition of the given type if it exists.
 func RemoveServiceCondition(svc *corev1.Service, conditionType tsapi.ConditionType) {
 	svc.Status.Conditions = slices.DeleteFunc(svc.Status.Conditions, func(cond metav1.Condition) bool {
@@ -63,6 +75,16 @@ func RemoveServiceCondition(svc *corev1.Service, conditionType tsapi.ConditionTy
 	})
 }
 
+func EgressServiceIsValidAndConfigured(svc *corev1.Service) bool {
+	for _, typ := range []tsapi.ConditionType{tsapi.EgressSvcValid, tsapi.EgressSvcConfigured} {
+		cond := GetServiceCondition(svc, typ)
+		if cond == nil || cond.Status != metav1.ConditionTrue {
+			return false
+		}
+	}
+	return true
+}
+
 // SetRecorderCondition ensures that Recorder status has a condition with the
 // given attributes. LastTransitionTime gets set every time condition's status
 // changes.
@@ -116,6 +138,17 @@ func ProxyClassIsReady(pc *tsapi.ProxyClass) bool {
 	return cond.Status == metav1.ConditionTrue && cond.ObservedGeneration == pc.Generation
 }
 
+func ProxyGroupIsReady(pg *tsapi.ProxyGroup) bool {
+	idx := xslices.IndexFunc(pg.Status.Conditions, func(cond metav1.Condition) bool {
+		return cond.Type == string(tsapi.ProxyGroupReady)
+	})
+	if idx == -1 {
+		return false
+	}
+	cond := pg.Status.Conditions[idx]
+	return cond.Status == metav1.ConditionTrue && cond.ObservedGeneration == pg.Generation
+}
+
 func DNSCfgIsReady(cfg *tsapi.DNSConfig) bool {
 	idx := xslices.IndexFunc(cfg.Status.Conditions, func(cond metav1.Condition) bool {
 		return cond.Type == string(tsapi.NameserverReady)