mirror of
https://github.com/tailscale/tailscale.git
synced 2025-07-31 16:23:44 +00:00
f421907c38
Adds a new reconciler for ProxyGroups of type kube-apiserver that will provision a Tailscale Service for each replica to advertise. Adds two new condition types to the ProxyGroup, TailscaleServiceValid and TailscaleServiceConfigured, to post updates on the state of that reconciler in a way that's consistent with the service-pg reconciler. The created Tailscale Service name is configurable via a new ProxyGroup field spec.kubeAPISserver.ServiceName, which expects a string of the form "svc:<dns-label>". Lots of supporting changes were needed to implement this in a way that's consistent with other operator workflows, including: * Pulled containerboot's ensureServicesUnadvertised and certManager into kube/ libraries to be shared with k8s-proxy. Use those in k8s-proxy to aid Service cert sharing between replicas and graceful Service shutdown. * For certManager, add an initial wait to the cert loop to wait until the domain appears in the devices's netmap to avoid a guaranteed error on the first issue attempt when it's quick to start. * Made several methods in ingress-for-pg.go and svc-for-pg.go into functions to share with the new reconciler * Added a Resource struct to the owner refs stored in Tailscale Service annotations to be able to distinguish between Ingress- and ProxyGroup- based Services that need cleaning up in the Tailscale API. * Added a ListVIPServices method to the internal tailscale client to aid cleaning up orphaned Services * Support for reading config from a kube Secret, and partial support for config reloading, to prevent us having to force Pod restarts when config changes. * Fixed up the zap logger so it's possible to set debug log level. Updates #13358 Change-Id: Ia9607441157dd91fb9b6ecbc318eecbef446e116 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
272 lines
13 KiB
YAML
272 lines
13 KiB
YAML
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.17.0
|
|
name: proxygroups.tailscale.com
|
|
spec:
|
|
group: tailscale.com
|
|
names:
|
|
kind: ProxyGroup
|
|
listKind: ProxyGroupList
|
|
plural: proxygroups
|
|
shortNames:
|
|
- pg
|
|
singular: proxygroup
|
|
scope: Cluster
|
|
versions:
|
|
- additionalPrinterColumns:
|
|
- description: Status of the deployed ProxyGroup resources.
|
|
jsonPath: .status.conditions[?(@.type == "ProxyGroupReady")].reason
|
|
name: Status
|
|
type: string
|
|
- description: URL of the kube-apiserver proxy advertised by the ProxyGroup devices, if any. Only applies to ProxyGroups of type kube-apiserver.
|
|
jsonPath: .status.url
|
|
name: URL
|
|
type: string
|
|
- description: ProxyGroup type.
|
|
jsonPath: .spec.type
|
|
name: Type
|
|
type: string
|
|
- jsonPath: .metadata.creationTimestamp
|
|
name: Age
|
|
type: date
|
|
name: v1alpha1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: |-
|
|
ProxyGroup defines a set of Tailscale devices that will act as proxies.
|
|
Depending on spec.Type, it can be a group of egress, ingress, or kube-apiserver
|
|
proxies. In addition to running a highly available set of proxies, ingress
|
|
and egress ProxyGroups also allow for serving many annotated Services from a
|
|
single set of proxies to minimise resource consumption.
|
|
|
|
For ingress and egress, use the tailscale.com/proxy-group annotation on a
|
|
Service to specify that the proxy should be implemented by a ProxyGroup
|
|
instead of a single dedicated proxy.
|
|
|
|
More info:
|
|
* https://tailscale.com/kb/1438/kubernetes-operator-cluster-egress
|
|
* https://tailscale.com/kb/1439/kubernetes-operator-cluster-ingress
|
|
|
|
For kube-apiserver, the ProxyGroup is a standalone resource. Use the
|
|
spec.kubeAPIServer field to configure options specific to the kube-apiserver
|
|
ProxyGroup type.
|
|
type: object
|
|
required:
|
|
- spec
|
|
properties:
|
|
apiVersion:
|
|
description: |-
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
may reject unrecognized values.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is a string value representing the REST resource this object represents.
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
Cannot be updated.
|
|
In CamelCase.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: Spec describes the desired ProxyGroup instances.
|
|
type: object
|
|
required:
|
|
- type
|
|
properties:
|
|
hostnamePrefix:
|
|
description: |-
|
|
HostnamePrefix is the hostname prefix to use for tailnet devices created
|
|
by the ProxyGroup. Each device will have the integer number from its
|
|
StatefulSet pod appended to this prefix to form the full hostname.
|
|
HostnamePrefix can contain lower case letters, numbers and dashes, it
|
|
must not start with a dash and must be between 1 and 62 characters long.
|
|
type: string
|
|
pattern: ^[a-z0-9][a-z0-9-]{0,61}$
|
|
kubeAPIServer:
|
|
description: |-
|
|
KubeAPIServer contains configuration specific to the kube-apiserver
|
|
ProxyGroup type. This field is only used when Type is set to "kube-apiserver".
|
|
type: object
|
|
properties:
|
|
hostname:
|
|
description: |-
|
|
Hostname is the hostname with which to expose the Kubernetes API server
|
|
proxies. Must be a valid DNS label no longer than 63 characters. If not
|
|
specified, the name of the ProxyGroup is used as the hostname. Must be
|
|
unique across the whole tailnet.
|
|
type: string
|
|
pattern: ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$
|
|
mode:
|
|
description: |-
|
|
Mode to run the API server proxy in. Supported modes are auth and noauth.
|
|
In auth mode, requests from the tailnet proxied over to the Kubernetes
|
|
API server are additionally impersonated using the sender's tailnet identity.
|
|
If not specified, defaults to auth mode.
|
|
type: string
|
|
enum:
|
|
- auth
|
|
- noauth
|
|
proxyClass:
|
|
description: |-
|
|
ProxyClass is the name of the ProxyClass custom resource that contains
|
|
configuration options that should be applied to the resources created
|
|
for this ProxyGroup. If unset, and there is no default ProxyClass
|
|
configured, the operator will create resources with the default
|
|
configuration.
|
|
type: string
|
|
replicas:
|
|
description: |-
|
|
Replicas specifies how many replicas to create the StatefulSet with.
|
|
Defaults to 2.
|
|
type: integer
|
|
format: int32
|
|
minimum: 0
|
|
tags:
|
|
description: |-
|
|
Tags that the Tailscale devices will be tagged with. Defaults to [tag:k8s].
|
|
If you specify custom tags here, make sure you also make the operator
|
|
an owner of these tags.
|
|
See https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.
|
|
Tags cannot be changed once a ProxyGroup device has been created.
|
|
Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.
|
|
type: array
|
|
items:
|
|
type: string
|
|
pattern: ^tag:[a-zA-Z][a-zA-Z0-9-]*$
|
|
type:
|
|
description: |-
|
|
Type of the ProxyGroup proxies. Supported types are egress, ingress, and kube-apiserver.
|
|
Type is immutable once a ProxyGroup is created.
|
|
type: string
|
|
enum:
|
|
- egress
|
|
- ingress
|
|
- kube-apiserver
|
|
x-kubernetes-validations:
|
|
- rule: self == oldSelf
|
|
message: ProxyGroup type is immutable
|
|
status:
|
|
description: |-
|
|
ProxyGroupStatus describes the status of the ProxyGroup resources. This is
|
|
set and managed by the Tailscale operator.
|
|
type: object
|
|
properties:
|
|
conditions:
|
|
description: |-
|
|
List of status conditions to indicate the status of the ProxyGroup
|
|
resources. Known condition types include `ProxyGroupReady` and
|
|
`ProxyGroupAvailable`.
|
|
|
|
* `ProxyGroupReady` indicates all ProxyGroup resources are reconciled and
|
|
all expected conditions are true.
|
|
* `ProxyGroupAvailable` indicates that at least one proxy is ready to
|
|
serve traffic.
|
|
|
|
For ProxyGroups of type kube-apiserver, there are two additional conditions:
|
|
|
|
* `KubeAPIServerProxyConfigured` indicates that at least one API server
|
|
proxy is configured and ready to serve traffic.
|
|
* `KubeAPIServerProxyValid` indicates that spec.kubeAPIServer config is
|
|
valid.
|
|
type: array
|
|
items:
|
|
description: Condition contains details for one aspect of the current state of this API Resource.
|
|
type: object
|
|
required:
|
|
- lastTransitionTime
|
|
- message
|
|
- reason
|
|
- status
|
|
- type
|
|
properties:
|
|
lastTransitionTime:
|
|
description: |-
|
|
lastTransitionTime is the last time the condition transitioned from one status to another.
|
|
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
|
type: string
|
|
format: date-time
|
|
message:
|
|
description: |-
|
|
message is a human readable message indicating details about the transition.
|
|
This may be an empty string.
|
|
type: string
|
|
maxLength: 32768
|
|
observedGeneration:
|
|
description: |-
|
|
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
|
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
|
with respect to the current state of the instance.
|
|
type: integer
|
|
format: int64
|
|
minimum: 0
|
|
reason:
|
|
description: |-
|
|
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
|
Producers of specific condition types may define expected values and meanings for this field,
|
|
and whether the values are considered a guaranteed API.
|
|
The value should be a CamelCase string.
|
|
This field may not be empty.
|
|
type: string
|
|
maxLength: 1024
|
|
minLength: 1
|
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
|
status:
|
|
description: status of the condition, one of True, False, Unknown.
|
|
type: string
|
|
enum:
|
|
- "True"
|
|
- "False"
|
|
- Unknown
|
|
type:
|
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
|
type: string
|
|
maxLength: 316
|
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
x-kubernetes-list-map-keys:
|
|
- type
|
|
x-kubernetes-list-type: map
|
|
devices:
|
|
description: List of tailnet devices associated with the ProxyGroup StatefulSet.
|
|
type: array
|
|
items:
|
|
type: object
|
|
required:
|
|
- hostname
|
|
properties:
|
|
hostname:
|
|
description: |-
|
|
Hostname is the fully qualified domain name of the device.
|
|
If MagicDNS is enabled in your tailnet, it is the MagicDNS name of the
|
|
node.
|
|
type: string
|
|
staticEndpoints:
|
|
description: StaticEndpoints are user configured, 'static' endpoints by which tailnet peers can reach this device.
|
|
type: array
|
|
items:
|
|
type: string
|
|
tailnetIPs:
|
|
description: |-
|
|
TailnetIPs is the set of tailnet IP addresses (both IPv4 and IPv6)
|
|
assigned to the device.
|
|
type: array
|
|
items:
|
|
type: string
|
|
x-kubernetes-list-map-keys:
|
|
- hostname
|
|
x-kubernetes-list-type: map
|
|
url:
|
|
description: |-
|
|
URL of the kube-apiserver proxy advertised by the ProxyGroup devices, if
|
|
any. Only applies to ProxyGroups of type kube-apiserver.
|
|
type: string
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|