summaryrefslogtreecommitdiffhomepage
path: root/cmd/containerboot
AgeCommit message (Collapse)AuthorFilesLines
2023-03-02cmd/containerboot,kube: consolidate the two kube clientsMaisem Ali3-218/+38
We had two implemenetations of the kube client, merge them. containerboot was also using a raw http.Transport, this also has the side effect of making it use a http.Client Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-02-03ipn/ipnlocal: add support to store certs in k8s secretsMaisem Ali1-1/+5
Fixes #5676 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-01-27all: update copyright and license headersWill Norris3-9/+6
This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>
2023-01-25cmd/k8s-operator: support setting a custom hostname.David Anderson2-0/+22
Updates #502 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-01-05cmd/containerboot: use TS_AUTHKEY as the parameter for auth keysDavid Anderson2-13/+40
We still accept the previous TS_AUTH_KEY for backwards compatibility, but the documented option name is the spelling we use everywhere else. Updates #6321 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-12-16cmd/containerboot: allow disabling secret storage in k8s.David Anderson2-10/+39
In some configurations, user explicitly do not want to store tailscale state in k8s secrets, because doing that leads to some annoying permission issues with sidecar containers. With this change, TS_KUBE_SECRET="" and TS_STATE_DIR=/foo will force storage to file when running in kubernetes. Fixes #6704. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-12-07cmd/containerboot: switch to IPN bus monitoring instead of polling.David Anderson3-186/+266
We still have to shell out to `tailscale up` because the container image's API includes "arbitrary flags to tailscale up", unfortunately. But this should still speed up startup a little, and also enables k8s-bound containers to update their device information as new netmap updates come in. Fixes #6657 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-12-07cmd/containerboot: gracefully degrade if missing patch permissions in k8s.David Anderson3-76/+180
Fixes #6629. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-12-06cmd/containerboot: check that k8s secret permissions are correct.David Anderson3-11/+70
Updates #6629. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-12-06cmd/containerboot: refactor tests to have more explicit phases.David Anderson1-182/+292
In preparation for making startup more complex with IPN bus watches. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-12-06cmd/containerboot: split tailscaled bringup and auth phases.David Anderson1-18/+26
In preparation for reworking auth to use IPN bus watch. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-12-06cmd/containerboot: fix some lint.David Anderson2-2/+2
Signed-off-by: David Anderson <danderson@tailscale.com>
2022-12-06cmd/containerboot: fix TS_STATE_DIR environment variableAnton Tolchanov2-2/+2
It's supposed to set `--statedir` rather than `--state` file. Fixes #6634. Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2022-11-16all: standardize on LocalAPIMaisem Ali1-24/+24
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-11-10cmd/containerboot: make a tests table, add more tests.David Anderson4-84/+443
Also fix a bugs found while adding the tests, oops. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-11-09cmd/containerboot: add tests.David Anderson3-0/+440
Signed-off-by: David Anderson <danderson@tailscale.com>
2022-11-07cmd/containerboot: be more targeted when enabling IP forwarding.David Anderson1-11/+43
Only enable forwarding for an IP family if any forwarding is required for that family. Fixes #6221. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-11-07cmd/containerboot: don't write device ID when not in Kubernetes.David Anderson1-1/+1
Fixes #6218. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-11-07cmd/containerboot: don't write device ID into non-existent secret.David Anderson1-1/+18
Fixes #6211 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-11-04all: remove old +build tagsBrad Fitzpatrick2-2/+0
The //go:build syntax was introduced in Go 1.17: https://go.dev/doc/go1.17#build-lines gofmt has kept the +build and go:build lines in sync since then, but enough time has passed. Time to remove them. Done with: perl -i -npe 's,^// \+build.*\n,,' $(git grep -l -F '+build') Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-03cmd/containerboot: PID1 for running tailscaled in a container.David Anderson2-0/+614
This implements the same functionality as the former run.sh, but in Go and with a little better awareness of tailscaled's lifecycle. Also adds TS_AUTH_ONCE, which fixes the unfortunate behavior run.sh had where it would unconditionally try to reauth every time if you gave it an authkey, rather than try to use it only if auth is actually needed. This makes it a bit nicer to deploy these containers in automation, since you don't have to run the container once, then go and edit its definition to remove authkeys. Signed-off-by: David Anderson <danderson@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.