6 Commits

Author	SHA1	Message	Date
Maisem Ali	24509f8b22	cmd/k8s-operator: add support for control plane assigned groups ... Previously we would use the Impersonate-Group header to pass through tags to the k8s api server. However, we would do nothing for non-tagged nodes. Now that we have a way to specify these via peerCaps respect those and send down groups for non-tagged nodes as well. For tagged nodes, it defaults to sending down the tags as groups to retain legacy behavior if there are no caps set. Otherwise, the tags are omitted. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2023-08-16 19:40:47 -04:00
Maisem Ali	df89b7de10	cmd/k8s-operator: disable HTTP/2 for the auth proxy ... Kubernetes uses SPDY/3.1 which is incompatible with HTTP/2, disable it in the transport and server. Fixes #7645 Fixes #7646 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2023-03-23 16:46:41 -07:00
Maisem Ali	c87782ba9d	cmd/k8s-operator: drop trailing dot in tagged node name ... Also update tailcfg docs. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2023-03-13 15:39:42 -07:00
Maisem Ali	558735bc63	cmd/k8s-operator: require HTTPS to be enabled for AuthProxy ... Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2023-03-13 12:32:55 -07:00
Maisem Ali	489e27f085	cmd/k8s-operator: make auth proxy pass tags as Impersonate-Group ... We were not handling tags at all, pass them through as Impersonate-Group headers. And use the FQDN for tagged nodes as Impersonate-User. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2023-03-13 12:32:12 -07:00
Maisem Ali	05adf22383	cmd/k8s-operator: add support for running an auth proxy ... Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2023-02-08 11:45:10 -08:00