BeckyPauley
6ee7bcb458
* cmd/{k8s-operator,containerboot,k8s-proxy},kube: support IPv6 in egress ProxyGroup
Add support for dual-stack and IPv6 clusters in egress ProxyGroup.
Previously, egress ProxyGroup only supported IPv4: the operator and
containerboot assumed IPv4 for ClusterIP Services, EndpointSlices,
and health check headers.
This change introduces the following:
- Create a per-family EndpointSlice instead of a single IPv4
EndpointSlice.
- Update the egress services readiness reconciler to account for
both IPv4 and IPv6 EndpointSlices.
- Update the pod readiness reconciler to use the primary Pod IP
(PodIPs[0]) for readiness checks, instead of hard-coding to use
IPv4.
- Update the /healthz handler to return both PodIPv4Header and
PodIPv6Header.
- Add an IPv6 address field to egress status.
- Update containerboot and k8s-proxy to use the new health check
logic.
Updates tailscale/corp#41677
Change-Id: If66a3146df48c75b1e65a71632bbc9fc75feded2
Signed-off-by: Becky Pauley <becky@tailscale.com>
* cmd/{k8s-operator,containerboot}: improve dual-stack egress ProxyGroup
On dual-stack clusters, an egress ProxyGroup Service has one EndpointSlice
per IP family (IPv4 and IPv6). However, EndpointSlices were only recreated
when the ExternalName Service configuration changed, so a deleted
EndpointSlice was not recreated. The egress readiness reconciler also had
no mechanism to identify which IP families should exist (previously only
an IPv4 EndpoitSlice was required).
We now create an EndpointSlice for every IP family the ClusterIP Service
supports.
Also mark an egress Service NotReady when an EndpointSlice for an expected IP
family (derived from the Service's ClusterIPs) is missing, so a
dual-stack Service missing a family's EndpointSlice is no longer reported
Ready.
Clarify that the egress pre-shutdown and Pod readiness health checks
verify only one IP family on dual-stack clusters.
Change-Id: I35b03daf76ac817cd516e9a731770b2d85f6ee16
Signed-off-by: Becky Pauley <becky@tailscale.com>
---------
Signed-off-by: Becky Pauley <becky@tailscale.com>
92 lines
2.1 KiB
Go
92 lines
2.1 KiB
Go
// Copyright (c) Tailscale Inc & contributors
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
//go:build !plan9
|
|
|
|
// Package health contains shared types and underlying methods for serving
|
|
// a `/healthz` endpoint for containerboot and k8s-proxy.
|
|
package health
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net/http"
|
|
"sync"
|
|
|
|
"tailscale.com/client/local"
|
|
"tailscale.com/ipn"
|
|
"tailscale.com/kube/kubetypes"
|
|
"tailscale.com/types/logger"
|
|
)
|
|
|
|
// Healthz is a simple health check server, if enabled it returns 200 OK if
|
|
// this tailscale node currently has at least one tailnet IP address else
|
|
// returns 503.
|
|
type Healthz struct {
|
|
sync.Mutex
|
|
hasAddrs bool
|
|
podIPv4 string
|
|
podIPv6 string
|
|
logger logger.Logf
|
|
}
|
|
|
|
func (h *Healthz) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
|
h.Lock()
|
|
defer h.Unlock()
|
|
|
|
if h.hasAddrs {
|
|
if h.podIPv4 != "" {
|
|
w.Header().Set(kubetypes.PodIPv4Header, h.podIPv4)
|
|
}
|
|
if h.podIPv6 != "" {
|
|
w.Header().Set(kubetypes.PodIPv6Header, h.podIPv6)
|
|
}
|
|
if _, err := w.Write([]byte("ok")); err != nil {
|
|
http.Error(w, fmt.Sprintf("error writing status: %v", err), http.StatusInternalServerError)
|
|
}
|
|
} else {
|
|
http.Error(w, "node currently has no tailscale IPs", http.StatusServiceUnavailable)
|
|
}
|
|
}
|
|
|
|
func (h *Healthz) Update(healthy bool) {
|
|
h.Lock()
|
|
defer h.Unlock()
|
|
|
|
if h.hasAddrs != healthy {
|
|
h.logger("Setting healthy %v", healthy)
|
|
}
|
|
h.hasAddrs = healthy
|
|
}
|
|
|
|
func (h *Healthz) MonitorHealth(ctx context.Context, lc *local.Client) error {
|
|
w, err := lc.WatchIPNBus(ctx, ipn.NotifyInitialNetMap)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to watch IPN bus: %w", err)
|
|
}
|
|
|
|
for {
|
|
n, err := w.Next()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if self := n.SelfChange; self != nil {
|
|
h.Update(len(self.Addresses) != 0)
|
|
}
|
|
}
|
|
}
|
|
|
|
// RegisterHealthHandlers registers a simple health handler at /healthz.
|
|
// A containerized tailscale instance is considered healthy if
|
|
// it has at least one tailnet IP address.
|
|
func RegisterHealthHandlers(mux *http.ServeMux, podIPv4, podIPv6 string, logger logger.Logf) *Healthz {
|
|
h := &Healthz{
|
|
podIPv4: podIPv4,
|
|
podIPv6: podIPv6,
|
|
logger: logger,
|
|
}
|
|
mux.Handle("GET /healthz", h)
|
|
return h
|
|
}
|