webnet/tailscale
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cmd/k8s-operator: migrate to tailscale-client-go-v2 (#19010)

Browse Source 
This commit modifies the kubernetes operator to use the `tailscale-client-go-v2`
package instead of the internal tailscale client it was previously using. This
now gives us the ability to expand out custom resources and features as they
become available via the API module.

The tailnet reconciler has also been modified to manage clients as tailnets
are created and removed, providing each subsequent reconciler with a single
`ClientProvider` that obtains a tailscale client for the respective tailnet
by name, or the operator's default when presented with a blank string.

Fixes: https://github.com/tailscale/corp/issues/38418

Signed-off-by: David Bond <davidsbond93@gmail.com>
This commit is contained in:
David Bond
2026-04-09 14:39:46 +01:00
committed by GitHub
parent b25920dfc0
commit 85d6ba9473
33 changed files with 916 additions and 940 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s-operator/reconciler/tailnet/mocks_test.go
+43 -7
View File
@@ -9,7 +9,9 @@ import (
"context"
"io"
"tailscale.com/internal/client/tailscale"
"tailscale.com/client/tailscale/v2"
"tailscale.com/k8s-operator/tsclient"
)
type (
@@ -18,28 +20,62 @@ type (
ErrorOnKeys bool
ErrorOnServices bool
}
MockDeviceResource struct {
tsclient.DeviceResource
Error bool
}
MockKeyResource struct {
tsclient.KeyResource
Error bool
}
MockVIPServiceResource struct {
tsclient.VIPServiceResource
Error bool
}
)
func (m MockTailnetClient) Devices(_ context.Context, _ *tailscale.DeviceFieldsOpts) ([]*tailscale.Device, error) {
if m.ErrorOnDevices {
func (m MockKeyResource) List(_ context.Context, _ bool) ([]tailscale.Key, error) {
if m.Error {
return nil, io.EOF
}
return nil, nil
}
func (m MockTailnetClient) Keys(_ context.Context) ([]string, error) {
if m.ErrorOnKeys {
func (m MockDeviceResource) List(_ context.Context, _ ...tailscale.ListDevicesOptions) ([]tailscale.Device, error) {
if m.Error {
return nil, io.EOF
}
return nil, nil
}
func (m MockTailnetClient) ListVIPServices(_ context.Context) (*tailscale.VIPServiceList, error) {
if m.ErrorOnServices {
func (m MockVIPServiceResource) List(_ context.Context) ([]tailscale.VIPService, error) {
if m.Error {
return nil, io.EOF
}
return nil, nil
}
func (m MockTailnetClient) Devices() tsclient.DeviceResource {
return MockDeviceResource{Error: m.ErrorOnDevices}
}
func (m MockTailnetClient) Keys() tsclient.KeyResource {
return MockKeyResource{Error: m.ErrorOnKeys}
}
func (m MockTailnetClient) VIPServices() tsclient.VIPServiceResource {
return MockVIPServiceResource{Error: m.ErrorOnServices}
}
func (m MockTailnetClient) LoginURL() string {
return ""
}
k8s-operator/reconciler/tailnet/tailnet.go
+42 -30
View File
@@ -12,12 +12,11 @@ import (
"context"
"errors"
"fmt"
"net/url"
"sync"
"time"
"go.uber.org/zap"
"golang.org/x/oauth2"
"golang.org/x/oauth2/clientcredentials"
corev1 "k8s.io/api/core/v1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -26,12 +25,13 @@ import (
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/manager"
"sigs.k8s.io/controller-runtime/pkg/reconcile"
"tailscale.com/client/tailscale/v2"
"tailscale.com/internal/client/tailscale"
"tailscale.com/ipn"
operatorutils "tailscale.com/k8s-operator"
tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
"tailscale.com/k8s-operator/reconciler"
"tailscale.com/k8s-operator/tsclient"
"tailscale.com/kube/kubetypes"
"tailscale.com/tstime"
"tailscale.com/util/clientmetric"
@@ -47,7 +47,8 @@ type (
tailscaleNamespace string
clock tstime.Clock
logger *zap.SugaredLogger
clientFunc func(*tsapi.Tailnet, *corev1.Secret) TailscaleClient
clientFunc func(*tsapi.Tailnet, *corev1.Secret) tsclient.Client
registry ClientRegistry
// Metrics related fields
mu sync.Mutex
@@ -68,14 +69,18 @@ type (
Logger *zap.SugaredLogger
// ClientFunc is a function that takes tailscale credentials and returns an implementation for the Tailscale
// HTTP API. This should generally be nil unless needed for testing.
ClientFunc func(*tsapi.Tailnet, *corev1.Secret) TailscaleClient
ClientFunc func(*tsapi.Tailnet, *corev1.Secret) tsclient.Client
// Registry is used to store and share initialized tailscale clients for use by other reconcilers.
Registry ClientRegistry
}
// The TailscaleClient interface describes types that interact with the Tailscale HTTP API.
TailscaleClient interface {
Devices(context.Context, *tailscale.DeviceFieldsOpts) ([]*tailscale.Device, error)
Keys(ctx context.Context) ([]string, error)
ListVIPServices(ctx context.Context) (*tailscale.VIPServiceList, error)
// The ClientRegistry interface describes types that can store initialized tailscale clients for use by other
// reconcilers.
ClientRegistry interface {
// Add should store the given tsclient.Client implementation for a specified tailnet.
Add(tailnet string, client tsclient.Client, ready bool)
// Remove should remove any tsclient.Client implementation for a specified tailnet.
Remove(tailnet string)
}
)
@@ -90,6 +95,7 @@ func NewReconciler(options ReconcilerOptions) *Reconciler {
clock: options.Clock,
logger: options.Logger.Named(reconcilerName),
clientFunc: options.ClientFunc,
registry: options.Registry,
}
}
@@ -137,6 +143,7 @@ func (r *Reconciler) delete(ctx context.Context, tailnet *tsapi.Tailnet) (reconc
r.tailnets.Remove(tailnet.UID)
r.mu.Unlock()
gaugeTailnetResources.Set(int64(r.tailnets.Len()))
r.registry.Remove(tailnet.Name)
return reconcile.Result{}, nil
}
@@ -193,11 +200,16 @@ func (r *Reconciler) createOrUpdate(ctx context.Context, tailnet *tsapi.Tailnet)
return reconcile.Result{RequeueAfter: time.Minute / 2}, nil
}
tsClient := r.createClient(ctx, tailnet, &secret)
tsClient, err := r.createClient(tailnet, &secret)
if err != nil {
return reconcile.Result{}, fmt.Errorf("failed to create tailnet client: %w", err)
}
// Second, we ensure the OAuth credentials supplied in the secret are valid and have the required scopes to access
// the various API endpoints required by the operator.
if ok := r.ensurePermissions(ctx, tsClient, tailnet); !ok {
r.registry.Add(tailnet.Name, tsClient, false)
if err = r.Status().Update(ctx, tailnet); err != nil {
return reconcile.Result{}, fmt.Errorf("failed to update Tailnet status for %q: %w", tailnet.Name, err)
}
@@ -226,6 +238,8 @@ func (r *Reconciler) createOrUpdate(ctx context.Context, tailnet *tsapi.Tailnet)
return reconcile.Result{}, fmt.Errorf("failed to add finalizer to Tailnet %q: %w", tailnet.Name, err)
}
r.registry.Add(tailnet.Name, tsClient, true)
return reconcile.Result{}, nil
}
@@ -235,9 +249,9 @@ const (
clientSecretKey = "client_secret"
)
func (r *Reconciler) createClient(ctx context.Context, tailnet *tsapi.Tailnet, secret *corev1.Secret) TailscaleClient {
func (r *Reconciler) createClient(tailnet *tsapi.Tailnet, secret *corev1.Secret) (tsclient.Client, error) {
if r.clientFunc != nil {
return r.clientFunc(tailnet, secret)
return r.clientFunc(tailnet, secret), nil
}
baseURL := ipn.DefaultControlURL
@@ -245,38 +259,36 @@ func (r *Reconciler) createClient(ctx context.Context, tailnet *tsapi.Tailnet, s
baseURL = tailnet.Spec.LoginURL
}
credentials := clientcredentials.Config{
ClientID: string(secret.Data[clientIDKey]),
ClientSecret: string(secret.Data[clientSecretKey]),
TokenURL: baseURL + "/api/v2/oauth/token",
base, err := url.Parse(baseURL)
if err != nil {
return nil, fmt.Errorf("failed to parse base URL %q: %w", baseURL, err)
}
source := credentials.TokenSource(ctx)
httpClient := oauth2.NewClient(ctx, source)
tsClient := tailscale.NewClient("-", nil)
tsClient.UserAgent = "tailscale-k8s-operator"
tsClient.HTTPClient = httpClient
tsClient.BaseURL = baseURL
return tsClient
return tsclient.Wrap(&tailscale.Client{
BaseURL: base,
UserAgent: "tailscale-k8s-operator",
Auth: &tailscale.OAuth{
ClientID: string(secret.Data[clientIDKey]),
ClientSecret: string(secret.Data[clientSecretKey]),
},
}), nil
}
func (r *Reconciler) ensurePermissions(ctx context.Context, tsClient TailscaleClient, tailnet *tsapi.Tailnet) bool {
func (r *Reconciler) ensurePermissions(ctx context.Context, tsClient tsclient.Client, tailnet *tsapi.Tailnet) bool {
// Perform basic list requests here to confirm that the OAuth credentials referenced on the Tailnet resource
// can perform the basic operations required for the operator to function. This has a caveat of only performing
// read actions, as we don't want to create arbitrary keys and VIP services. However, it will catch when a user
// has completely forgotten an entire scope that's required.
var errs error
if _, err := tsClient.Devices(ctx, nil); err != nil {
if _, err := tsClient.Devices().List(ctx); err != nil {
errs = errors.Join(errs, fmt.Errorf("failed to list devices: %w", err))
}
if _, err := tsClient.Keys(ctx); err != nil {
if _, err := tsClient.Keys().List(ctx, false); err != nil {
errs = errors.Join(errs, fmt.Errorf("failed to list auth keys: %w", err))
}
if _, err := tsClient.ListVIPServices(ctx); err != nil {
if _, err := tsClient.VIPServices().List(ctx); err != nil {
errs = errors.Join(errs, fmt.Errorf("failed to list tailscale services: %w", err))
}
k8s-operator/reconciler/tailnet/tailnet_test.go
+7 -5
View File
@@ -18,6 +18,7 @@ import (
tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
"tailscale.com/k8s-operator/reconciler/tailnet"
"tailscale.com/k8s-operator/tsclient"
"tailscale.com/tstest"
)
@@ -36,7 +37,7 @@ func TestReconciler_Reconcile(t *testing.T) {
Secret *corev1.Secret
ExpectsError bool
ExpectedConditions []metav1.Condition
ClientFunc func(*tsapi.Tailnet, *corev1.Secret) tailnet.TailscaleClient
ClientFunc func(*tsapi.Tailnet, *corev1.Secret) tsclient.Client
}{
{
Name: "ignores-unknown-tailnet-requests",
@@ -201,7 +202,7 @@ func TestReconciler_Reconcile(t *testing.T) {
"client_secret": []byte("test"),
},
},
ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tailnet.TailscaleClient {
ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tsclient.Client {
return &MockTailnetClient{ErrorOnDevices: true}
},
ExpectedConditions: []metav1.Condition{
@@ -240,7 +241,7 @@ func TestReconciler_Reconcile(t *testing.T) {
"client_secret": []byte("test"),
},
},
ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tailnet.TailscaleClient {
ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tsclient.Client {
return &MockTailnetClient{ErrorOnServices: true}
},
ExpectedConditions: []metav1.Condition{
@@ -279,7 +280,7 @@ func TestReconciler_Reconcile(t *testing.T) {
"client_secret": []byte("test"),
},
},
ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tailnet.TailscaleClient {
ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tsclient.Client {
return &MockTailnetClient{ErrorOnKeys: true}
},
ExpectedConditions: []metav1.Condition{
@@ -318,7 +319,7 @@ func TestReconciler_Reconcile(t *testing.T) {
"client_secret": []byte("test"),
},
},
ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tailnet.TailscaleClient {
ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tsclient.Client {
return &MockTailnetClient{}
},
ExpectedConditions: []metav1.Condition{
@@ -349,6 +350,7 @@ func TestReconciler_Reconcile(t *testing.T) {
Logger: logger.Sugar(),
ClientFunc: tc.ClientFunc,
TailscaleNamespace: "tailscale",
Registry: tsclient.NewProvider(nil),
}
reconciler := tailnet.NewReconciler(opts)