tailscale/docs/k8s
Maisem Ali 66cc9e6301
docs/k8s: make run.sh handle SIGINT
It was previously using jobcontrol to achieve this, but that apparently
doesn't work when there is no tty. This makes it so that it directly
handles SIGINT and SIGTERM and passes it on to tailscaled. I tested this
works on a Digital Ocean K8s cluster.

Fixes #5512

Signed-off-by: Maisem Ali <maisem@tailscale.com>
(cherry picked from commit 060ecb010f)
2022-09-08 05:28:57 -07:00
..
Makefile fix: typo rename, ROUTES -> TS_ROUTES 2022-06-30 20:23:37 -07:00
proxy.yaml docs/k8s: add IPv6 forwarding in proxy.yaml 2022-08-30 06:03:15 -07:00
README.md docs/k8s: add prefix to (#5167) 2022-07-25 15:10:07 -07:00
role.yaml build_docker.sh: add run.sh as an entrypoint to the docker image 2022-06-07 00:45:49 +05:00
rolebinding.yaml docs/k8s: add instructions on how to run as a sidecar or a proxy. 2021-10-13 13:26:53 -04:00
run.sh docs/k8s: make run.sh handle SIGINT 2022-09-08 05:28:57 -07:00
sa.yaml build_docker.sh: add run.sh as an entrypoint to the docker image 2022-06-07 00:45:49 +05:00
sidecar.yaml build_docker.sh: add run.sh as an entrypoint to the docker image 2022-06-07 00:45:49 +05:00
subnet.yaml build_docker.sh: add run.sh as an entrypoint to the docker image 2022-06-07 00:45:49 +05:00
userspace-sidecar.yaml build_docker.sh: add run.sh as an entrypoint to the docker image 2022-06-07 00:45:49 +05:00

Overview

There are quite a few ways of running Tailscale inside a Kubernetes Cluster, some of the common ones are covered in this doc.

Instructions

Setup

  1. (Optional) Create the following secret which will automate login.
    You will need to get an auth key from Tailscale Admin Console.
    If you don't provide the key, you can still authenticate using the url in the logs.

    apiVersion: v1
    kind: Secret
    metadata:
      name: tailscale-auth
    stringData:
      TS_AUTH_KEY: tskey-...
    
  2. Tailscale (v1.16+) supports storing state inside a Kubernetes Secret.

    Configure RBAC to allow the Tailscale pod to read/write the tailscale secret.

    export SA_NAME=tailscale
    export TS_KUBE_SECRET=tailscale-auth
    make rbac
    

Sample Sidecar

Running as a sidecar allows you to directly expose a Kubernetes pod over Tailscale. This is particularly useful if you do not wish to expose a service on the public internet. This method allows bi-directional connectivity between the pod and other devices on the Tailnet. You can use ACLs to control traffic flow.

  1. Create and login to the sample nginx pod with a Tailscale sidecar

    make sidecar
    # If not using an auth key, authenticate by grabbing the Login URL here:
    kubectl logs nginx ts-sidecar
    
  2. Check if you can to connect to nginx over Tailscale:

    curl http://nginx
    

    Or, if you have MagicDNS disabled:

    curl "http://$(tailscale ip -4 nginx)"
    

Userspace Sidecar

You can also run the sidecar in userspace mode. The obvious benefit is reducing the amount of permissions Tailscale needs to run, the downside is that for outbound connectivity from the pod to the Tailnet you would need to use either the SOCKS proxy or HTTP proxy.

  1. Create and login to the sample nginx pod with a Tailscale sidecar

    make userspace-sidecar
    # If not using an auth key, authenticate by grabbing the Login URL here:
    kubectl logs nginx ts-sidecar
    
  2. Check if you can to connect to nginx over Tailscale:

    curl http://nginx
    

    Or, if you have MagicDNS disabled:

    curl "http://$(tailscale ip -4 nginx)"
    

Sample Proxy

Running a Tailscale proxy allows you to provide inbound connectivity to a Kubernetes Service.

  1. Provide the ClusterIP of the service you want to reach by either:

    Creating a new deployment

    kubectl create deployment nginx --image nginx
    kubectl expose deployment nginx --port 80
    export TS_DEST_IP="$(kubectl get svc nginx -o=jsonpath='{.spec.clusterIP}')"
    

    Using an existing service

    export TS_DEST_IP="$(kubectl get svc <SVC_NAME> -o=jsonpath='{.spec.clusterIP}')"
    
  2. Deploy the proxy pod

    make proxy
    # If not using an auth key, authenticate by grabbing the Login URL here:
    kubectl logs proxy
    
  3. Check if you can to connect to nginx over Tailscale:

    curl http://proxy
    

    Or, if you have MagicDNS disabled:

    curl "http://$(tailscale ip -4 proxy)"
    

Subnet Router

Running a Tailscale subnet router allows you to access the entire Kubernetes cluster network (assuming NetworkPolicies allow) over Tailscale.

  1. Identify the Pod/Service CIDRs that cover your Kubernetes cluster. These will vary depending on which CNI you are using and on the Cloud Provider you are using. Add these to the TS_ROUTES variable as comma-separated values.

    SERVICE_CIDR=10.20.0.0/16
    POD_CIDR=10.42.0.0/15
    export TS_ROUTES=$SERVICE_CIDR,$POD_CIDR
    
  2. Deploy the subnet-router pod.

    make subnet-router
    # If not using an auth key, authenticate by grabbing the Login URL here:
    kubectl logs subnet-router
    
  3. In the Tailscale admin console, ensure that the routes for the subnet-router are enabled.

  4. Make sure that any client you want to connect from has --accept-routes enabled.

  5. Check if you can connect to a ClusterIP or a PodIP over Tailscale:

    # Get the Service IP
    INTERNAL_IP="$(kubectl get svc <SVC_NAME> -o=jsonpath='{.spec.clusterIP}')"
    # or, the Pod IP
    # INTERNAL_IP="$(kubectl get po <POD_NAME> -o=jsonpath='{.status.podIP}')"
    INTERNAL_PORT=8080
    curl http://$INTERNAL_IP:$INTERNAL_PORT