From c0d06214175713bd17f7dbe739e77063afdcc3d2 Mon Sep 17 00:00:00 2001 From: Nick Khyl Date: Fri, 5 Jun 2026 15:46:31 -0500 Subject: [PATCH] logpolicy,tsnet: remove syspolicy dependency tsnet depends on logpolicy, which in turn depended on util/syspolicy because of a single LogTarget policy setting it uses. In this commit, we replace that dependency with a feature.Hook, which only tailscaled or its platform-specific alternatives should set. Updates #20031 Signed-off-by: Nick Khyl --- cmd/k8s-operator/depaware.txt | 10 ++++------ cmd/tailscaled/depaware.txt | 2 +- cmd/tailscaled/tailscaled.go | 4 ++++ cmd/tsidp/depaware.txt | 12 +++++------- logpolicy/logpolicy.go | 14 ++++++++++---- logpolicy/maybe_syspolicy.go | 8 -------- tsnet/depaware.txt | 12 +++++------- tsnet/tsnet_test.go | 1 + 8 files changed, 30 insertions(+), 33 deletions(-) delete mode 100644 logpolicy/maybe_syspolicy.go diff --git a/cmd/k8s-operator/depaware.txt b/cmd/k8s-operator/depaware.txt index f7a193b83..fba68300a 100644 --- a/cmd/k8s-operator/depaware.txt +++ b/cmd/k8s-operator/depaware.txt @@ -739,7 +739,6 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/ tailscale.com/feature/condregister/useproxy from tailscale.com/tsnet tailscale.com/feature/oauthkey from tailscale.com/feature/condregister/oauthkey tailscale.com/feature/portmapper from tailscale.com/feature/condregister/portmapper - tailscale.com/feature/syspolicy from tailscale.com/logpolicy tailscale.com/feature/useproxy from tailscale.com/feature/condregister/useproxy tailscale.com/health from tailscale.com/control/controlclient+ tailscale.com/health/healthmsg from tailscale.com/ipn/ipnlocal @@ -895,16 +894,15 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/ tailscale.com/util/set from tailscale.com/cmd/k8s-operator+ tailscale.com/util/singleflight from tailscale.com/control/controlclient+ tailscale.com/util/slicesx from tailscale.com/appc+ - tailscale.com/util/syspolicy from tailscale.com/feature/syspolicy tailscale.com/util/syspolicy/internal from tailscale.com/util/syspolicy/setting+ tailscale.com/util/syspolicy/internal/loggerx from tailscale.com/util/syspolicy/internal/metrics+ tailscale.com/util/syspolicy/internal/metrics from tailscale.com/util/syspolicy/source tailscale.com/util/syspolicy/pkey from tailscale.com/control/controlclient+ tailscale.com/util/syspolicy/policyclient from tailscale.com/control/controlclient+ - tailscale.com/util/syspolicy/ptype from tailscale.com/util/syspolicy+ - tailscale.com/util/syspolicy/rsop from tailscale.com/util/syspolicy+ - tailscale.com/util/syspolicy/setting from tailscale.com/util/syspolicy+ - tailscale.com/util/syspolicy/source from tailscale.com/util/syspolicy+ + tailscale.com/util/syspolicy/ptype from tailscale.com/ipn/ipnlocal+ + tailscale.com/util/syspolicy/rsop from tailscale.com/ipn/localapi + tailscale.com/util/syspolicy/setting from tailscale.com/client/local+ + tailscale.com/util/syspolicy/source from tailscale.com/util/syspolicy/rsop tailscale.com/util/testenv from tailscale.com/control/controlclient+ tailscale.com/util/truncate from tailscale.com/logtail tailscale.com/util/usermetric from tailscale.com/health+ diff --git a/cmd/tailscaled/depaware.txt b/cmd/tailscaled/depaware.txt index 3499a8736..8189512d7 100644 --- a/cmd/tailscaled/depaware.txt +++ b/cmd/tailscaled/depaware.txt @@ -308,7 +308,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de tailscale.com/feature/runtimemetrics from tailscale.com/feature/condregister L tailscale.com/feature/sdnotify from tailscale.com/feature/condregister LD tailscale.com/feature/ssh from tailscale.com/cmd/tailscaled - tailscale.com/feature/syspolicy from tailscale.com/feature/condregister+ + tailscale.com/feature/syspolicy from tailscale.com/feature/condregister tailscale.com/feature/taildrop from tailscale.com/feature/condregister tailscale.com/feature/tailnetlock from tailscale.com/feature/condregister L tailscale.com/feature/tap from tailscale.com/feature/condregister diff --git a/cmd/tailscaled/tailscaled.go b/cmd/tailscaled/tailscaled.go index 44341ea3c..69f4ff5bc 100644 --- a/cmd/tailscaled/tailscaled.go +++ b/cmd/tailscaled/tailscaled.go @@ -438,6 +438,10 @@ func run() (err error) { var publicLogID logid.PublicID if buildfeatures.HasLogTail { + logpolicy.GetLogTarget.Set(func() string { + target, _ := sys.PolicyClientOrDefault().GetString(pkey.LogTarget, "") + return target + }) pol := logpolicy.Options{ Collection: logtail.CollectionNode, diff --git a/cmd/tsidp/depaware.txt b/cmd/tsidp/depaware.txt index 9552addef..4a173e487 100644 --- a/cmd/tsidp/depaware.txt +++ b/cmd/tsidp/depaware.txt @@ -156,7 +156,6 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar tailscale.com/feature/condregister/useproxy from tailscale.com/tsnet tailscale.com/feature/oauthkey from tailscale.com/feature/condregister/oauthkey tailscale.com/feature/portmapper from tailscale.com/feature/condregister/portmapper - tailscale.com/feature/syspolicy from tailscale.com/logpolicy tailscale.com/feature/useproxy from tailscale.com/feature/condregister/useproxy tailscale.com/health from tailscale.com/control/controlclient+ tailscale.com/health/healthmsg from tailscale.com/ipn/ipnlocal @@ -293,16 +292,15 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar tailscale.com/util/set from tailscale.com/control/controlclient+ tailscale.com/util/singleflight from tailscale.com/control/controlclient+ tailscale.com/util/slicesx from tailscale.com/appc+ - tailscale.com/util/syspolicy from tailscale.com/feature/syspolicy - tailscale.com/util/syspolicy/internal from tailscale.com/util/syspolicy+ - tailscale.com/util/syspolicy/internal/loggerx from tailscale.com/util/syspolicy+ + tailscale.com/util/syspolicy/internal from tailscale.com/util/syspolicy/internal/metrics+ + tailscale.com/util/syspolicy/internal/loggerx from tailscale.com/util/syspolicy/internal/metrics+ tailscale.com/util/syspolicy/internal/metrics from tailscale.com/util/syspolicy/source tailscale.com/util/syspolicy/pkey from tailscale.com/control/controlclient+ tailscale.com/util/syspolicy/policyclient from tailscale.com/control/controlclient+ - tailscale.com/util/syspolicy/ptype from tailscale.com/util/syspolicy+ - tailscale.com/util/syspolicy/rsop from tailscale.com/ipn/localapi+ + tailscale.com/util/syspolicy/ptype from tailscale.com/ipn/ipnlocal+ + tailscale.com/util/syspolicy/rsop from tailscale.com/ipn/localapi tailscale.com/util/syspolicy/setting from tailscale.com/client/local+ - tailscale.com/util/syspolicy/source from tailscale.com/util/syspolicy+ + tailscale.com/util/syspolicy/source from tailscale.com/util/syspolicy/rsop tailscale.com/util/testenv from tailscale.com/control/controlclient+ tailscale.com/util/truncate from tailscale.com/logtail tailscale.com/util/usermetric from tailscale.com/health+ diff --git a/logpolicy/logpolicy.go b/logpolicy/logpolicy.go index 901a713f1..63021bfc3 100644 --- a/logpolicy/logpolicy.go +++ b/logpolicy/logpolicy.go @@ -54,13 +54,15 @@ import ( "tailscale.com/util/eventbus" "tailscale.com/util/must" "tailscale.com/util/racebuild" - "tailscale.com/util/syspolicy/pkey" - "tailscale.com/util/syspolicy/policyclient" "tailscale.com/util/testenv" "tailscale.com/version" "tailscale.com/version/distro" ) +// GetLogTarget is an optional hook to register a function +// that returns the log target URL to be used by logpolicy. +var GetLogTarget feature.Hook[func() string] + var getLogTargetOnce struct { sync.Once v string // URL of logs server, or empty for default @@ -68,8 +70,12 @@ var getLogTargetOnce struct { func getLogTarget() string { getLogTargetOnce.Do(func() { - envTarget, _ := os.LookupEnv("TS_LOG_TARGET") - getLogTargetOnce.v, _ = policyclient.Get().GetString(pkey.LogTarget, envTarget) + if f, ok := GetLogTarget.GetOk(); ok { + getLogTargetOnce.v = f() + } + if getLogTargetOnce.v == "" { + getLogTargetOnce.v, _ = os.LookupEnv("TS_LOG_TARGET") + } }) return getLogTargetOnce.v diff --git a/logpolicy/maybe_syspolicy.go b/logpolicy/maybe_syspolicy.go deleted file mode 100644 index 7cdaabcc7..000000000 --- a/logpolicy/maybe_syspolicy.go +++ /dev/null @@ -1,8 +0,0 @@ -// Copyright (c) Tailscale Inc & contributors -// SPDX-License-Identifier: BSD-3-Clause - -//go:build !ts_omit_syspolicy - -package logpolicy - -import _ "tailscale.com/feature/syspolicy" diff --git a/tsnet/depaware.txt b/tsnet/depaware.txt index 031cc9a6d..0fe1d8d1a 100644 --- a/tsnet/depaware.txt +++ b/tsnet/depaware.txt @@ -152,7 +152,6 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware) tailscale.com/feature/condregister/useproxy from tailscale.com/tsnet tailscale.com/feature/oauthkey from tailscale.com/feature/condregister/oauthkey tailscale.com/feature/portmapper from tailscale.com/feature/condregister/portmapper - tailscale.com/feature/syspolicy from tailscale.com/logpolicy tailscale.com/feature/useproxy from tailscale.com/feature/condregister/useproxy tailscale.com/health from tailscale.com/control/controlclient+ tailscale.com/health/healthmsg from tailscale.com/ipn/ipnlocal @@ -288,16 +287,15 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware) tailscale.com/util/set from tailscale.com/control/controlclient+ tailscale.com/util/singleflight from tailscale.com/control/controlclient+ tailscale.com/util/slicesx from tailscale.com/appc+ - tailscale.com/util/syspolicy from tailscale.com/feature/syspolicy - tailscale.com/util/syspolicy/internal from tailscale.com/util/syspolicy+ - tailscale.com/util/syspolicy/internal/loggerx from tailscale.com/util/syspolicy+ + tailscale.com/util/syspolicy/internal from tailscale.com/util/syspolicy/internal/metrics+ + tailscale.com/util/syspolicy/internal/loggerx from tailscale.com/util/syspolicy/internal/metrics+ tailscale.com/util/syspolicy/internal/metrics from tailscale.com/util/syspolicy/source tailscale.com/util/syspolicy/pkey from tailscale.com/control/controlclient+ tailscale.com/util/syspolicy/policyclient from tailscale.com/control/controlclient+ - tailscale.com/util/syspolicy/ptype from tailscale.com/util/syspolicy+ - tailscale.com/util/syspolicy/rsop from tailscale.com/ipn/localapi+ + tailscale.com/util/syspolicy/ptype from tailscale.com/ipn/ipnlocal+ + tailscale.com/util/syspolicy/rsop from tailscale.com/ipn/localapi tailscale.com/util/syspolicy/setting from tailscale.com/client/local+ - tailscale.com/util/syspolicy/source from tailscale.com/util/syspolicy+ + tailscale.com/util/syspolicy/source from tailscale.com/util/syspolicy/rsop tailscale.com/util/testenv from tailscale.com/control/controlclient+ tailscale.com/util/truncate from tailscale.com/logtail tailscale.com/util/usermetric from tailscale.com/health+ diff --git a/tsnet/tsnet_test.go b/tsnet/tsnet_test.go index 606a3f187..d6c125b50 100644 --- a/tsnet/tsnet_test.go +++ b/tsnet/tsnet_test.go @@ -2926,6 +2926,7 @@ func TestDeps(t *testing.T) { BadDeps: map[string]string{ "golang.org/x/crypto/ssh": "tsnet should not depend on SSH", "golang.org/x/crypto/ssh/internal/bcrypt_pbkdf": "tsnet should not depend on SSH", + "tailscale.com/feature/syspolicy": "tsnet should not depend on syspolicy", "tailscale.com/ipn/store/awsstore": "tsnet callers wanting AWS state storage should import awsstore themselves", "tailscale.com/ipn/store/kubestore": "tsnet callers wanting Kubernetes state storage should import kubestore themselves", "tailscale.com/wif": "tsnet callers wanting workload identity federation should import tailscale.com/feature/identityfederation themselves",