David Bond
2cb86cf65e
This commit contains the implementation of multi-tailnet support within the Kubernetes Operator
Each of our custom resources now expose the `spec.tailnet` field. This field is a string that must match the name of an existing `Tailnet` resource. A `Tailnet` resource looks like this:
```yaml
apiVersion: tailscale.com/v1alpha1
kind: Tailnet
metadata:
name: example # This is the name that must be referenced by other resources
spec:
credentials:
secretName: example-oauth
```
Each `Tailnet` references a `Secret` resource that contains a set of oauth credentials. This secret must be created in the same namespace as the operator:
```yaml
apiVersion: v1
kind: Secret
metadata:
name: example-oauth # This is the name that's referenced by the Tailnet resource.
namespace: tailscale
stringData:
client_id: "client-id"
client_secret: "client-secret"
```
When created, the operator performs a basic check that the oauth client has access to all required scopes. This is done using read actions on devices, keys & services. While this doesn't capture a missing "write" permission, it catches completely missing permissions. Once this check passes, the `Tailnet` moves into a ready state and can be referenced. Attempting to use a `Tailnet` in a non-ready state will stall the deployment of `Connector`s, `ProxyGroup`s and `Recorder`s until the `Tailnet` becomes ready.
The `spec.tailnet` field informs the operator that a `Connector`, `ProxyGroup`, or `Recorder` must be given an auth key generated using the specified oauth client. For backwards compatibility, the set of credentials the operator is configured with are considered the default. That is, where `spec.tailnet` is not set, the resource will be deployed in the same tailnet as the operator.
Updates https://github.com/tailscale/corp/issues/34561
77 lines
2.2 KiB
Go
77 lines
2.2 KiB
Go
// Copyright (c) Tailscale Inc & AUTHORS
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
//go:build !plan9
|
|
|
|
package v1alpha1
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"tailscale.com/k8s-operator/apis"
|
|
|
|
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
"k8s.io/apimachinery/pkg/runtime/schema"
|
|
"k8s.io/client-go/kubernetes/scheme"
|
|
)
|
|
|
|
// SchemeGroupVersion is group version used to register these objects
|
|
var SchemeGroupVersion = schema.GroupVersion{Group: apis.GroupName, Version: "v1alpha1"}
|
|
|
|
// Resource takes an unqualified resource and returns a Group qualified GroupResource
|
|
func Resource(resource string) schema.GroupResource {
|
|
return SchemeGroupVersion.WithResource(resource).GroupResource()
|
|
}
|
|
|
|
var (
|
|
SchemeBuilder runtime.SchemeBuilder
|
|
localSchemeBuilder = &SchemeBuilder
|
|
AddToScheme = localSchemeBuilder.AddToScheme
|
|
|
|
GlobalScheme *runtime.Scheme
|
|
)
|
|
|
|
func init() {
|
|
// We only register manually written functions here. The registration of the
|
|
// generated functions takes place in the generated files. The separation
|
|
// makes the code compile even when the generated files are missing.
|
|
localSchemeBuilder.Register(addKnownTypes)
|
|
|
|
GlobalScheme = runtime.NewScheme()
|
|
// Add core types
|
|
if err := scheme.AddToScheme(GlobalScheme); err != nil {
|
|
panic(fmt.Sprintf("failed to add k8s.io scheme: %s", err))
|
|
}
|
|
// Add tailscale.com types
|
|
if err := AddToScheme(GlobalScheme); err != nil {
|
|
panic(fmt.Sprintf("failed to add tailscale.com scheme: %s", err))
|
|
}
|
|
// Add apiextensions types (CustomResourceDefinitions/CustomResourceDefinitionLists)
|
|
if err := apiextensionsv1.AddToScheme(GlobalScheme); err != nil {
|
|
panic(fmt.Sprintf("failed to add apiextensions.k8s.io scheme: %s", err))
|
|
}
|
|
}
|
|
|
|
// Adds the list of known types to api.Scheme.
|
|
func addKnownTypes(scheme *runtime.Scheme) error {
|
|
scheme.AddKnownTypes(SchemeGroupVersion,
|
|
&Connector{},
|
|
&ConnectorList{},
|
|
&ProxyClass{},
|
|
&ProxyClassList{},
|
|
&DNSConfig{},
|
|
&DNSConfigList{},
|
|
&Recorder{},
|
|
&RecorderList{},
|
|
&ProxyGroup{},
|
|
&ProxyGroupList{},
|
|
&Tailnet{},
|
|
&TailnetList{},
|
|
)
|
|
|
|
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
|
|
return nil
|
|
}
|