tailscale/cmd/containerboot
Tom Proctor 711698f5a9
cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)
Previously, the operator checked the ProxyGroup status fields for
information on how many of the proxies had successfully authed. Use
their state Secrets instead as a more reliable source of truth.

containerboot has written device_fqdn and device_ips keys to the
state Secret since inception, and pod_uid since 1.78.0, so there's
no need to use the API for that data. Read it from the state Secret
for consistency. However, to ensure we don't read data from a
previous run of containerboot, make sure we reset containerboot's
state keys on startup.

One other knock-on effect of that is ProxyGroups can briefly be
marked not Ready while a Pod is restarting. Introduce a new
ProxyGroupAvailable condition to more accurately reflect
when downstream controllers can implement flows that rely on a
ProxyGroup having at least 1 proxy Pod running.

Fixes #16327

Change-Id: I026c18e9d23e87109a471a87b8e4fb6271716a66

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-06-27 18:10:04 +01:00
..
certs_test.go cmd/containerboot: manage HA Ingress TLS certs from containerboot (#15303) 2025-03-14 17:33:08 +00:00
certs.go cmd/{k8s-operator,containerboot}: check TLS cert before advertising VIPService (#15427) 2025-03-26 01:32:13 +00:00
egressservices_test.go cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services (#15897) 2025-05-19 10:42:03 +01:00
egressservices.go cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services (#15897) 2025-05-19 10:42:03 +01:00
forwarding.go cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658) 2024-10-03 20:15:00 +01:00
healthz.go cmd/{containerboot,k8s-operator},kube/kubetypes: unadvertise ingress services on shutdown (#15451) 2025-04-09 10:11:15 +01:00
ingressservices_test.go cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services (#15897) 2025-05-19 10:42:03 +01:00
ingressservices.go cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services (#15897) 2025-05-19 10:42:03 +01:00
kube_test.go cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328) 2025-06-27 18:10:04 +01:00
kube.go cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328) 2025-06-27 18:10:04 +01:00
main_test.go cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328) 2025-06-27 18:10:04 +01:00
main.go cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328) 2025-06-27 18:10:04 +01:00
metrics.go cmd/{containerboot,k8s-operator},kube/kubetypes: unadvertise ingress services on shutdown (#15451) 2025-04-09 10:11:15 +01:00
serve_test.go cmd/containerboot: manage HA Ingress TLS certs from containerboot (#15303) 2025-03-14 17:33:08 +00:00
serve.go cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services (#15897) 2025-05-19 10:42:03 +01:00
services.go cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services (#15897) 2025-05-19 10:42:03 +01:00
settings_test.go cmd/containerboot: allow setting --accept-dns via TS_EXTRA_ARGS again (#16129) 2025-05-30 11:30:03 +01:00
settings.go cmd/containerboot: allow setting --accept-dns via TS_EXTRA_ARGS again (#16129) 2025-05-30 11:30:03 +01:00
tailscaled.go cmd/containerboot: speed up tests (#14883) 2025-04-08 23:34:23 +01:00
test_tailscale.sh cmd/containerboot: make a tests table, add more tests. 2022-11-10 09:14:27 -08:00
test_tailscaled.sh cmd/containerboot: avoid leaking bash scripts after test runs 2023-09-21 13:17:48 -07:00