cmd/k8s-operator: migrate to tailscale-client-go-v2 (#19010)

This commit modifies the kubernetes operator to use the `tailscale-client-go-v2`
package instead of the internal tailscale client it was previously using. This
now gives us the ability to expand out custom resources and features as they
become available via the API module.

The tailnet reconciler has also been modified to manage clients as tailnets
are created and removed, providing each subsequent reconciler with a single
`ClientProvider` that obtains a tailscale client for the respective tailnet
by name, or the operator's default when presented with a blank string.

Fixes: https://github.com/tailscale/corp/issues/38418

Signed-off-by: David Bond <davidsbond93@gmail.com>

k8s-operator/tsclient/client.go

@@ -0,0 +1,83 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package tsclient provides a mockable wrapper around the tailscale-client-go-v2 package for use by the Kubernetes
+// operator. It also contains the Provider type used to manage multiple instances of tailscale clients for different
+// tailnets.
+package tsclient
+
+import (
+	"context"
+
+	"tailscale.com/client/tailscale/v2"
+)
+
+type (
+	// The Client interface describes types that interact with the Tailscale API.
+	Client interface {
+		// LoginURL should return the url of the Tailscale control plane.
+		LoginURL() string
+		// Devices should return a DeviceResource implementation used to interact with the devices API.
+		Devices() DeviceResource
+		// Keys should return a KeyResource implementation used to interact with the keys API.
+		Keys() KeyResource
+		// VIPServices should return a VIPServiceResource implementation used to interact with the VIP services API.
+		VIPServices() VIPServiceResource
+	}
+
+	// The DeviceResource interface describes types that expose device related API endpoints.
+	DeviceResource interface {
+		// Delete should delete a device with a matching id.
+		Delete(ctx context.Context, id string) error
+		// List should return all devices based on the specified options.
+		List(ctx context.Context, opts ...tailscale.ListDevicesOptions) ([]tailscale.Device, error)
+		// Get should return the device with the matching identifier.
+		Get(ctx context.Context, id string) (*tailscale.Device, error)
+	}
+
+	// The KeyResource interface describes types that expose key related API endpoints.
+	KeyResource interface {
+		// CreateAuthKey should create and return a new auth key used to authenticate a device.
+		CreateAuthKey(ctx context.Context, ckr tailscale.CreateKeyRequest) (*tailscale.Key, error)
+		// List should return keys created by the caller or all keys if the provided boolean is set to true.
+		List(ctx context.Context, all bool) ([]tailscale.Key, error)
+	}
+
+	// The VIPServiceResource interface describes types that expose vip service related API endpoints.
+	VIPServiceResource interface {
+		// List should return all existing vip services within the tailnet.
+		List(ctx context.Context) ([]tailscale.VIPService, error)
+		// Delete should remove a named service from the tailnet.
+		Delete(ctx context.Context, name string) error
+		// Get should return the vip service associated with the given name.
+		Get(ctx context.Context, name string) (*tailscale.VIPService, error)
+		// CreateOrUpdate should update the provided vip service, creating it if it does not exist.
+		CreateOrUpdate(ctx context.Context, svc tailscale.VIPService) error
+	}
+
+	clientWrapper struct {
+		loginURL string
+		client   *tailscale.Client
+	}
+)
+
+// Wrap converts a given tailscale.Client into a Client.
+func Wrap(client *tailscale.Client) Client {
+	return &clientWrapper{client: client, loginURL: client.BaseURL.String()}
+}
+
+func (c *clientWrapper) Devices() DeviceResource {
+	return c.client.Devices()
+}
+
+func (c *clientWrapper) Keys() KeyResource {
+	return c.client.Keys()
+}
+
+func (c *clientWrapper) VIPServices() VIPServiceResource {
+	return c.client.VIPServices()
+}
+
+func (c *clientWrapper) LoginURL() string {
+	return c.loginURL
+}

k8s-operator/tsclient/provider.go

@@ -0,0 +1,77 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tsclient
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+)
+
+type (
+	// The Provider type is used to manage multiple Client implementations for different tailnets.
+	Provider struct {
+		defaultClient Client
+		mu            sync.RWMutex
+		clients       map[string]Client
+		readiness     map[string]bool
+	}
+)
+
+var (
+	// ErrClientNotFound is the error given when calling Provider.For with a tailnet that has not yet been registered
+	// with the provider.
+	ErrClientNotFound = errors.New("client not found")
+	// ErrNotReady is the error given when calling Provider.For with a tailnet that has not yet been declared as
+	// ready to use by the operator.
+	ErrNotReady = errors.New("tailnet not ready")
+)
+
+// NewProvider returns a new instance of the Provider type that uses the given Client implementation as the default
+// client. This client will be given when calling Provider.For with a blank tailnet name.
+func NewProvider(defaultClient Client) *Provider {
+	return &Provider{
+		defaultClient: defaultClient,
+		clients:       make(map[string]Client),
+		readiness:     make(map[string]bool),
+	}
+}
+
+// Add a Client implementation for a given tailnet.
+func (p *Provider) Add(tailnet string, client Client, ready bool) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	p.clients[tailnet] = client
+	p.readiness[tailnet] = ready
+}
+
+// Remove the Client implementation associated with the given tailnet.
+func (p *Provider) Remove(tailnet string) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	delete(p.clients, tailnet)
+}
+
+// For returns a Client implementation associated with the given tailnet. Returns ErrClientNotFound if the given
+// tailnet does not exist. Use a blank tailnet name to obtain the default Client.
+func (p *Provider) For(tailnet string) (Client, error) {
+	if tailnet == "" {
+		return p.defaultClient, nil
+	}
+
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+
+	if client, ok := p.clients[tailnet]; ok {
+		if ready, _ := p.readiness[tailnet]; !ready {
+			return nil, fmt.Errorf("%w: %s", ErrNotReady, tailnet)
+		}
+
+		return client, nil
+	}
+
+	return nil, fmt.Errorf("%w: %s", ErrClientNotFound, tailnet)
+}