summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2024-12-13cmd/containerboot: introduce `TS_STATE` env vardocker_stateLee Briggs2-10/+60
Fixes #12180 Fixed #13409 Signed-off-by: Lee Briggs <lee@leebriggs.co.uk>
2024-12-12ssh/tailssh: remove unused public key supportBrad Fitzpatrick6-364/+54
When we first made Tailscale SSH, we assumed people would want public key support soon after. Turns out that hasn't been the case; people love the Tailscale identity authentication and check mode. In light of CVE-2024-45337, just remove all our public key code to not distract people, and to make the code smaller. We can always get it back from git if needed. Updates tailscale/corp#25131 Updates golang/go#70779 Co-authored-by: Percy Wegmann <percy@tailscale.com> Change-Id: I87a6e79c2215158766a81942227a18b247333c22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-12-12util/dnsname: use vizerror for all errorsAdrian Dewhurst1-9/+9
The errors emitted by util/dnsname are all written at least moderately friendly and none of them emit sensitive information. They should be safe to display to end users. Updates tailscale/corp#9025 Change-Id: Ic58705075bacf42f56378127532c5f28ff6bfc89 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>
2024-12-11types/bools: add IfElse (#14272)Joe Tsai3-17/+37
The IfElse function is equivalent to the ternary (c ? a : b) operator in many other languages like C. Unfortunately, this function cannot perform short-circuit evaluation like in many other languages, but this is a restriction that's not much different than the pre-existing cmp.Or function. The argument against ternary operators in Go is that nested ternary operators become unreadable (e.g., (c1 ? (c2 ? a : b) : (c2 ? x : y))). But a single layer of ternary expressions can sometimes make code much more readable. Having the bools.IfElse function gives code authors the ability to decide whether use of this is more readable or not. Obviously, code authors will need to be judicious about their use of this helper function. Readability is more of an art than a science. Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-12-11types/iox: add function types for Reader and Writer (#14366)Joe Tsai2-0/+62
Throughout our codebase we have types that only exist only to implement an io.Reader or io.Writer, when it would have been simpler, cleaner, and more readable to use an inlined function literal that closes over the relevant types. This is arguably more readable since it keeps the semantic logic in place rather than have it be isolated elsewhere. Note that a function literal that closes over some variables is semantic equivalent to declaring a struct with fields and having the Read or Write method mutate those fields. Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-12-11cmd/containerboot: don't attempt to patch a Secret field without permissions ↵Irbe Krumina3-1/+3
(#14365) Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-12-11cmd/k8s-operator,k8s-operator: operator integration tests (#12792)Tom Proctor4-0/+469
This is the start of an integration/e2e test suite for the tailscale operator. It currently only tests two major features, ingress proxy and API server proxy, but we intend to expand it to cover more features over time. It also only supports manual runs for now. We intend to integrate it into CI checks in a separate update when we have planned how to securely provide CI with the secrets required for connecting to a test tailnet. Updates #12622 Change-Id: I31e464bb49719348b62a563790f2bc2ba165a11b Co-authored-by: Irbe Krumina <irbe@tailscale.com> Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2024-12-11cmd/containerboot: add more tests, check that egress service config only set ↵Irbe Krumina2-8/+119
on kube (#14360) Updates tailscale/tailscale#14357 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-12-11cmd/containerboot: don't attempt to write kube Secret in non-kube ↵Irbe Krumina1-2/+4
environments (#14358) Updates tailscale/tailscale#14354 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-12-11cmd/containerboot: guard kubeClient against nil dereference (#14357)Bjorn Neergaard1-2/+4
A method on kc was called unconditionally, even if was not initialized, leading to a nil pointer dereference when TS_SERVE_CONFIG was set outside Kubernetes. Add a guard symmetric with other uses of the kubeClient. Fixes #14354. Signed-off-by: Bjorn Neergaard <bjorn@neersighted.com>
2024-12-10.github: Bump github/codeql-action from 3.27.1 to 3.27.6 (#14332)dependabot[bot]1-3/+3
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.27.1 to 3.27.6. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/4f3212b61783c3c68e8309a0f18a699764811cda...aa578102511db1f4524ed59b8cc2bae4f6e88195) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-10.github: Bump actions/cache from 4.1.2 to 4.2.0 (#14331)dependabot[bot]1-5/+5
Bumps [actions/cache](https://github.com/actions/cache) from 4.1.2 to 4.2.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/6849a6489940f00c2f30c0fb92c6274307ccb58a...1bd1e32a3bdc45362d1e726936510720a7c30a57) --- updated-dependencies: - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-10prober,derp/derphttp: make dev-mode DERP probes work without TLS (#14347)Mario Minardi2-12/+19
Make dev-mode DERP probes work without TLS. Properly dial port `3340` when not using HTTPS when dialing nodes in `derphttp_client`. Skip verifying TLS state in `newConn` if we are not running a prober. Updates tailscale/corp#24635 Signed-off-by: Percy Wegmann <percy@tailscale.com> Co-authored-by: Percy Wegmann <percy@tailscale.com>
2024-12-10derp: add env var setting server send queue depth (#14334)Mike O'Driscoll2-5/+46
Use envknob to configure the per client send queue depth for the derp server. Fixes tailscale/corp#24978 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2024-12-09hostinfo: fix testing in container (#14330)Tom Proctor1-3/+7
Previously this unit test failed if it was run in a container. Update the assert to focus on exactly the condition we are trying to assert: the package type should only be 'container' if we use the build tag. Updates #14317 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2024-12-06cmd/stunc: enforce read timeout deadline (#14309)Mike O'Driscoll1-7/+27
Make argparsing use flag for adding a new parameter that requires parsing. Enforce a read timeout deadline waiting for response from the stun server provided in the args. Otherwise the program will never exit. Fixes #14267 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2024-12-06VERSION.txt: this is v1.79.0v1.79.0-preNick Khyl1-1/+1
Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-12-06cmd,{get-authkey,tailscale}: remove unnecessary scope qualifier from OAuth ↵Percy Wegmann2-2/+0
clients OAuth clients that were used to generate an auth_key previously specified the scope 'device'. 'device' is not an actual scope, the real scope is 'devices'. The resulting OAuth token ended up including all scopes from the specified OAuth client, so the code was able to successfully create auth_keys. It's better not to hardcode a scope here anyway, so that we have the flexibility of changing which scope(s) are used in the future without having to update old clients. Since the qualifier never actually did anything, this commit simply removes it. Updates tailscale/corp#24934 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-12-05health: fix TestHealthMetric to pass on release branchBrad Fitzpatrick1-3/+9
Fixes #14302 Change-Id: I9fd893a97711c72b713fe5535f2ccb93fadf7452 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-12-05logpolicy: cleanup options API and allow setting http.Client (#11503)Joe Tsai1-56/+129
This package grew organically over time and is an awful mix of explicitly declared options and globally set parameters via environment variables and other subtle effects. Add a new Options and TransportOptions type to allow for the creation of a Policy or http.RoundTripper with some set of options. The options struct avoids the need to add yet more NewXXX functions for every possible combination of ordered arguments. The goal of this refactor is to allow specifying the http.Client to use with the Policy. Updates tailscale/corp#18177 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-12-05cmd/gitops-pusher: default previousEtag to controlEtag (#14296)Andrew Lytvynov1-6/+6
If previousEtag is empty, then we assume control ACLs were not modified manually and push the local ACLs. Instead, we defaulted to localEtag which would be different if local ACLs were different from control. AFAIK this was always buggy, but never reported? Fixes #14295 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2024-12-05go.mod: bump x/net and dependenciesJames Tucker2-18/+18
Pulling in upstream fix for #14201. Updates #14201 Signed-off-by: James Tucker <james@tailscale.com>
2024-12-05cmd/derper: allow absent SNI when using manual certs and IP literal for hostnameBrad Fitzpatrick4-7/+108
Updates #11776 Change-Id: I81756415feb630da093833accc3074903ebd84a7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-12-05net/netcheck: preserve STUN port defaulting to 3478 (#14289)Irbe Krumina1-0/+3
Updates tailscale/tailscale#14287 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-12-05cmd/k8s-operator: don't error for transient failures (#14073)Tom Proctor8-17/+84
Every so often, the ProxyGroup and other controllers lose an optimistic locking race with other controllers that update the objects they create. Stop treating this as an error event, and instead just log an info level log line for it. Fixes #14072 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2024-12-04cmd/tailscale,net/netcheck: add debug feature to force preferred DERPJames Tucker7-1/+140
This provides an interface for a user to force a preferred DERP outcome for all future netchecks that will take precedence unless the forced region is unreachable. The option does not persist and will be lost when the daemon restarts. Updates tailscale/corp#18997 Updates tailscale/corp#24755 Signed-off-by: James Tucker <james@tailscale.com>
2024-12-04net/tstun: remove tailscaled_outbound_dropped_packets_total reason=acl ↵Brad Fitzpatrick2-4/+5
metric for now Updates #14280 Change-Id: Idff102b3d7650fc9dfbe0c340168806bdf542d76 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-12-04cmd/{containerboot,k8s-operator},kube/kubetypes: kube Ingress L7 proxies ↵Irbe Krumina12-128/+443
only advertise HTTPS endpoint when ready (#14171) cmd/containerboot,kube/kubetypes,cmd/k8s-operator: detect if Ingress is created in a tailnet that has no HTTPS This attempts to make Kubernetes Operator L7 Ingress setup failures more explicit: - the Ingress resource now only advertises HTTPS endpoint via status.ingress.loadBalancer.hostname when/if the proxy has succesfully loaded serve config - the proxy attempts to catch cases where HTTPS is disabled for the tailnet and logs a warning Updates tailscale/tailscale#12079 Updates tailscale/tailscale#10407 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-12-04cmd/k8s-operator: fix a bunch of status equality checks (#14270)Irbe Krumina8-15/+15
Updates tailscale/tailscale#14269 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-12-03cmd/k8s-operator/deploy/chart: allow reading OAuth creds from a CSI driver's ↵Oliver Rahner3-4/+30
volume and annotating operator's Service account (#14264) cmd/k8s-operator/deploy/chart: allow reading OAuth creds from a CSI driver's volume and annotating operator's Service account Updates #14264 Signed-off-by: Oliver Rahner <o.rahner@dke-data.com>
2024-12-03cmd/k8s-operator: avoid port collision with metrics endpoint (#14185)Tom Proctor1-7/+7
When the operator enables metrics on a proxy, it uses the port 9001, and in the near future it will start using 9002 for the debug endpoint as well. Make sure we don't choose ports from a range that includes 9001 so that we never clash. Setting TS_SOCKS5_SERVER, TS_HEALTHCHECK_ADDR_PORT, TS_OUTBOUND_HTTP_PROXY_LISTEN, and PORT could also open arbitrary ports, so we will need to document that users should not choose ports from the 10000-11000 range for those settings. Updates #13406 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2024-12-03cmd/k8s-operator,k8s-operator,go.mod: optionally create ServiceMonitor (#14248)Irbe Krumina21-22/+877
* cmd/k8s-operator,k8s-operator,go.mod: optionally create ServiceMonitor Adds a new spec.metrics.serviceMonitor field to ProxyClass. If that's set to true (and metrics are enabled), the operator will create a Prometheus ServiceMonitor for each proxy to which the ProxyClass applies. Additionally, create a metrics Service for each proxy that has metrics enabled. Updates tailscale/tailscale#11292 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-12-03cmd/k8s-operator,docs/k8s: run tun mode proxies in privileged containers ↵Irbe Krumina9-41/+36
(#14262) We were previously relying on unintended behaviour by runc where all containers where by default given read/write/mknod permissions for tun devices. This behaviour was removed in https://github.com/opencontainers/runc/pull/3468 and released in runc 1.2. Containerd container runtime, used by Docker and majority of Kubernetes distributions bumped runc to 1.2 in 1.7.24 https://github.com/containerd/containerd/releases/tag/v1.7.24 thus breaking our reference tun mode Tailscale Kubernetes manifests and Kubernetes operator proxies. This PR changes the all Kubernetes container configs that run Tailscale in tun mode to privileged. This should not be a breaking change because all these containers would run in a Pod that already has a privileged init container. Updates tailscale/tailscale#14256 Updates tailscale/tailscale#10814 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-12-02IPN: Update ServeConfig to accept configuration for Services.KevinLiang104-2/+144
This commit updates ServeConfig to allow configuration to Services (VIPServices for now) via Serve. The scope of this commit is only adding the Services field to ServeConfig. The field doesn't actually allow packet flowing yet. The purpose of this commit is to unblock other work on k8s end. Updates #22953 Signed-off-by: KevinLiang10 <37811973+KevinLiang10@users.noreply.github.com>
2024-12-02net/netcheck: clean up ICMP probe AddrPort lookupBrad Fitzpatrick2-29/+36
Fixes #14200 Change-Id: Ib086814cf63dda5de021403fe1db4fb2a798eaae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-12-02cmd/containerboot: serve health on local endpoint (#14246)Tom Proctor7-66/+251
* cmd/containerboot: serve health on local endpoint We introduced stable (user) metrics in #14035, and `TS_LOCAL_ADDR_PORT` with it. Rather than requiring users to specify a new addr/port combination for each new local endpoint they want the container to serve, this combines the health check endpoint onto the local addr/port used by metrics if `TS_ENABLE_HEALTH_CHECK` is used instead of `TS_HEALTHCHECK_ADDR_PORT`. `TS_LOCAL_ADDR_PORT` now defaults to binding to all interfaces on 9002 so that it works more seamlessly and with less configuration in environments other than Kubernetes, where the operator always overrides the default anyway. In particular, listening on localhost would not be accessible from outside the container, and many scripted container environments do not know the IP address of the container before it's started. Listening on all interfaces allows users to just set one env var (`TS_ENABLE_METRICS` or `TS_ENABLE_HEALTH_CHECK`) to get a fully functioning local endpoint they can query from outside the container. Updates #14035, #12898 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2024-12-02cmd/checkmetrics: add command for checking metrics against kbBrad Fitzpatrick2-0/+142
This commit adds a command to validate that all the metrics that are registring in the client are also present in a path or url. It is intended to be ran from the KB against the latest version of tailscale. Updates tailscale/corp#24066 Updates tailscale/corp#22075 Co-Authored-By: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-11-29cmd/k8s-operator: always set stateful filtering to false (#14216)Irbe Krumina3-22/+11
Updates tailscale/tailscale#12108 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-29Makefile,./build_docker.sh: update kube operator image build target name ↵Irbe Krumina2-2/+2
(#14251) Updates tailscale/corp#24540 Updates tailscale/tailscale#12914 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-29cmd/k8s-operator: fix port name change bug for egress ProxyGroup proxies ↵Irbe Krumina3-24/+77
(#14247) Ensure that the ExternalName Service port names are always synced to the ClusterIP Service, to fix a bug where if users created a Service with a single unnamed port and later changed to 1+ named ports, the operator attempted to apply an invalid multi-port Service with an unnamed port. Also, fixes a small internal issue where not-yet Service status conditons were lost on a spec update. Updates tailscale/tailscale#10102 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-28tsnet: remove flaky test marker from metricsKristoffer Dalby1-4/+4
Updates #13420 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-11-28wgengine/magicsock: packet/bytes metrics should not count discoKristoffer Dalby1-3/+3
Updates #13420 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-11-28tsnet: validate sent data in metrics testKristoffer Dalby1-7/+13
Updates #13420 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-11-28tsnet: split bytes and routes metrics testsKristoffer Dalby1-61/+123
Updates #13420 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-11-28tsnet: send less data in metrics integration testKristoffer Dalby1-8/+6
this commit reduced the amount of data sent in the metrics data integration test from 10MB to 1MB. On various machines 10MB was quite flaky, while 1MB has not failed once on 10000 runs. Updates #13420 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-11-28health: move health metrics test to health_testKristoffer Dalby3-33/+50
Updates #13420 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-11-27logtail: avoid bytes.Buffer allocation (#11858)Joe Tsai1-2/+10
Re-use a pre-allocated bytes.Buffer struct and shallow the copy the result of bytes.NewBuffer into it to avoid allocating the struct. Note that we're only reusing the bytes.Buffer struct itself and not the underling []byte temporarily stored within it. Updates #cleanup Updates tailscale/corp#18514 Updates golang/go#67004 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-11-27ipn/localapi: count localapi requests to metric endpointsAnton Tolchanov1-1/+5
Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-11-26control/controlhttp: set *health.Tracker in testsAndrew Dunham1-0/+3
Observed during another PR: https://github.com/tailscale/tailscale/actions/runs/12040045880/job/33569141807 Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I9e0f49a35485fa2e097892737e5e3c95bf775a90
2024-11-26cmd/tailscale/cli: fix format stringNick Khyl1-2/+2
Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.