mirrors/tailscale
1
0
Fork 0
Code Issues Pull Requests Projects Wiki Activity
8d84720edb
tailscale/cmd/k8s-operator
History
Tom Proctor 8d84720edb
cmd/k8s-operator: update ProxyGroup config Secrets instead of patch (#15353) 
There was a flaky failure case where renaming a TLS hostname for an
ingress might leave the old hostname dangling in tailscaled config. This
happened when the proxygroup reconciler loop had an outdated resource
version of the config Secret in its cache after the
ingress-pg-reconciler loop had very recently written it to delete the
old hostname. As the proxygroup reconciler then did a patch, there was
no conflict and it reinstated the old hostname.

This commit updates the patch to an update operation so that if the
resource version is out of date it will fail with an optimistic lock
error. It also checks for equality to reduce the likelihood that we make
the update API call in the first place, because most of the time the
proxygroup reconciler is not even making an update to the Secret in the
case that the hostname has changed.

Updates tailscale/corp#24795

Change-Id: Ie23a97440063976c9a8475d24ab18253e1f89050
Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-03-19 13:49:36 +00:00
..
deploy cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
e2e cmd,tsnet,internal/client: create internal shim to deprecated control plane API 2025-02-18 10:23:04 -06:00
generate cmd/k8s-operator,k8s-operator: add ProxyGroup CRD (#13591) 2024-09-27 01:05:56 +01:00
connector_test.go go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601) 2025-01-17 05:37:53 +00:00
connector.go cmd/k8s-operator: don't error for transient failures (#14073) 2024-12-05 12:11:22 +00:00
depaware.txt tsweb: split promvarz into an optional dependency 2025-03-18 16:57:04 -07:00
dnsrecords_test.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
dnsrecords.go cmd/k8s-operator: don't error for transient failures (#14073) 2024-12-05 12:11:22 +00:00
egress-eps_test.go go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601) 2025-01-17 05:37:53 +00:00
egress-eps.go cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436) 2025-01-29 07:35:50 +00:00
egress-pod-readiness_test.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
egress-pod-readiness.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
egress-services_test.go cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436) 2025-01-29 07:35:50 +00:00
egress-services-readiness_test.go go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601) 2025-01-17 05:37:53 +00:00
egress-services-readiness.go cmd/k8s-operator: check that cluster traffic is routed to egress ProxyGroup Pod before marking it as ready (#14792) 2025-01-30 08:47:45 +00:00
egress-services.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
ingress_test.go go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601) 2025-01-17 05:37:53 +00:00
ingress-for-pg_test.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
ingress-for-pg.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
ingress.go cmd/k8s-operator: ensure HA Ingress can operate in multicluster mode. (#15157) 2025-03-06 23:13:10 +00:00
metrics_resources.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
nameserver_test.go go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601) 2025-01-17 05:37:53 +00:00
nameserver.go cmd/k8s-operator: don't error for transient failures (#14073) 2024-12-05 12:11:22 +00:00
operator_test.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
operator.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
proxy_test.go cmd/k8s-operator,ssh/tailssh,tsnet: optionally record 'kubectl exec' sessions via Kubernetes operator's API server proxy (#12274) 2024-07-08 21:18:55 +01:00
proxy.go all: use new LocalAPI client package location 2025-02-05 14:41:42 -08:00
proxyclass_test.go go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601) 2025-01-17 05:37:53 +00:00
proxyclass.go cmd/k8s-operator,k8s-operator: allow users to set custom labels for the optional ServiceMonitor (#14475) 2025-01-09 07:15:19 +00:00
proxygroup_specs.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
proxygroup_test.go cmd/k8s-operator: update ProxyGroup config Secrets instead of patch (#15353) 2025-03-19 13:49:36 +00:00
proxygroup.go cmd/k8s-operator: update ProxyGroup config Secrets instead of patch (#15353) 2025-03-19 13:49:36 +00:00
sts_test.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
sts.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
svc.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
testutils_test.go cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308) 2025-03-19 12:49:31 +00:00
tsclient.go client/tailscale,cmd/k8s-operator,internal/client/tailscale: move VIP service client methods into internal control client 2025-02-18 16:25:17 -06:00
tsrecorder_specs_test.go cmd/k8s-operator,k8s-operator,kube: Add TSRecorder CRD + controller (#13299) 2024-09-11 12:19:29 +01:00
tsrecorder_specs.go cmd/k8s-operator,kube/kubeclient,docs/k8s: update rbac to emit events + small fixes (#14164) 2024-11-20 14:22:34 +00:00
tsrecorder_test.go go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601) 2025-01-17 05:37:53 +00:00
tsrecorder.go cmd/k8s-operator: wait for VIPService before updating HA Ingress status (#15343) 2025-03-19 08:53:15 +00:00