You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Irbe Krumina 096b090caf cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets (#13531) ... * cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets This commit is first part of the work to allow running multiple replicas of the Kubernetes operator egress proxies per tailnet service + to allow exposing multiple tailnet services via each proxy replica. This expands the existing iptables/nftables-based proxy configuration mechanism. A proxy can now be configured to route to one or more tailnet targets via a (mounted) config file that, for each tailnet target, specifies: - the target's tailnet IP or FQDN - mappings of container ports to which cluster workloads will send traffic to tailnet target ports where the traffic should be forwarded. Example configfile contents: { "some-svc": {"tailnetTarget":{"fqdn":"foo.tailnetxyz.ts.net","ports"{"tcp:4006:80":{"protocol":"tcp","matchPort":4006,"targetPort":80},"tcp:4007:443":{"protocol":"tcp","matchPort":4007,"targetPort":443}}}} } A proxy that is configured with this config file will configure firewall rules to route cluster traffic to the tailnet targets. It will then watch the config file for updates as well as monitor relevant netmap updates and reconfigure firewall as needed. This adds a bunch of new iptables/nftables functionality to make it easier to dynamically update the firewall rules without needing to restart the proxy Pod as well as to make it easier to debug/understand the rules: - for iptables, each portmapping is a DNAT rule with a comment pointing at the 'service',i.e: -A PREROUTING ! -i tailscale0 -p tcp -m tcp --dport 4006 -m comment --comment "some-svc:tcp:4006 -> tcp:80" -j DNAT --to-destination 100.64.1.18:80 Additionally there is a SNAT rule for each tailnet target, to mask the source address. - for nftables, a separate prerouting chain is created for each tailnet target and all the portmapping rules are placed in that chain. This makes it easier to look up rules and delete services when no longer needed. (nftables allows hooking a custom chain to a prerouting hook, so no extra work is needed to ensure that the rules in the service chains are evaluated). The next steps will be to get the Kubernetes Operator to generate the configfile and ensure it is mounted to the relevant proxy nodes. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>		2 years ago
..
cache	util/cache: fix missing interface methods (#11275)	2 years ago
cibuild	all: update copyright and license headers	3 years ago
clientmetric	util/clientmetric: allow client metric values to be provided by a function	3 years ago
cloudenv	all: use math/rand/v2 more	2 years ago
cmpver	util/cmpver: add Less/LessEq helper funcs	2 years ago
codegen	cmd/cloner, cmd/viewer, util/codegen: add support for aliases of cloneable types	2 years ago
cstruct	all: use Go 1.22 range-over-int	2 years ago
ctxkey	all: use reflect.TypeFor now available in Go 1.22 (#11078)	2 years ago
deephash	util/deephash: fix test regression on 32-bit	2 years ago
dirwalk	all: use tstest.Replace more	3 years ago
dnsname	all: use Go 1.22 range-over-int	2 years ago
execqueue	control/controlclient,util/execqueue: extract execqueue into a package	2 years ago
expvarx	all: use Go 1.22 range-over-int	2 years ago
fastuuid	all: use Go 1.22 range-over-int	2 years ago
goroutines	util/goroutines: let ScrubbedGoroutineDump get only current stack	3 years ago
groupmember	util/groupmember: fail earlier if group doesn't exist, use slices.Contains	2 years ago
hashx	all: use Go 1.22 range-over-int	2 years ago
httphdr	util/httphdr: add new package for parsing HTTP headers (#9797)	3 years ago
httpm	util/httpm: don't run test if .git doesn't exist	2 years ago
jsonutil	all: use Go 1.22 range-over-int	2 years ago
limiter	all: add test for package comments, fix, add comments as needed	2 years ago
lineread	all: update copyright and license headers	3 years ago
linuxfw	cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets (#13531)	2 years ago
lru	util/lru: add Clear method	2 years ago
mak	various: add golangci-lint, fix issues (#7905)	3 years ago
multierr	all: use Go 1.22 range-over-int	2 years ago
must	all: update copyright and license headers	3 years ago
nocasemaps	all: use Go 1.22 range-over-int	2 years ago
osdiag	all: add test for package comments, fix, add comments as needed	2 years ago
osshare	all: add test for package comments, fix, add comments as needed	2 years ago
osuser	util/osuser: turn wasm check into a const expression	2 years ago
pidowner	all: use Go 1.22 range-over-int	2 years ago
pool	util/pool: add package for storing and using a pool of items	2 years ago
precompress	all: update copyright and license headers	3 years ago
progresstracking	ipn/localapi: add support for multipart POST to file-put	2 years ago
quarantine	all: update copyright and license headers	3 years ago
race	all: use Go 1.22 range-over-int	2 years ago
racebuild	all: update copyright and license headers	3 years ago
rands	wgengine/magicsock: use math/rands/v2	2 years ago
reload	all: use math/rand/v2 more	2 years ago
ringbuffer	all: use Go 1.22 range-over-int	2 years ago
set	util/set: add Of variant of SetOf that takes variadic parameter	2 years ago
singleflight	util/singleflight: add DoChanContext	2 years ago
slicesx	util/slicesx: add FirstElementEqual and LastElementEqual	2 years ago
syspolicy	control/controlclient,posture,util/syspolicy: use predefined syspolicy keys instead of string literals	2 years ago
sysresources	util/sysresources, magicsock: scale DERP buffer based on system memory	3 years ago
systemd	all: update copyright and license headers	3 years ago
testenv	util/testenv: add new package to hold InTest	3 years ago
topk	all: use Go 1.22 range-over-int	2 years ago
truncate	util/truncate: support []byte as well (#11614)	2 years ago
uniq	all: use Go 1.22 range-over-int	2 years ago
usermetric	util/usermetrics: make usermetrics non-global	2 years ago
vizerror	util/vizerror: add As function to get wrapped Error	3 years ago
winutil	util/winutil: add GetRegUserString/SetRegUserString accessors for storage and retrieval of string values in HKEY_CURRENT_USER	2 years ago
zstdframe	all: use Go 1.22 range-over-int	2 years ago