summaryrefslogtreecommitdiffhomepage
path: root/cmd
AgeCommit message (Collapse)AuthorFilesLines
2024-11-19kube/{kubeapi,kubeclient},ipn/store/kubestore,cmd/{containerboot,k8s-operato ↵Irbe Krumina8-17/+44
r}: emit kube store Events (#14112) Adds functionality to kube client to emit Events. Updates kube store to emit Events when tailscaled state has been loaded, updated or if any errors where encountered during those operations. This should help in cases where an error related to state loading/updating caused the Pod to crash in a loop- unlike logs of the originally failed container instance, Events associated with the Pod will still be accessible even after N restarts. Updates tailscale/tailscale#14080 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-18ipn/ipnlocal: add IPN Bus NotifyRateLimit watch bit NotifyRateLimitBrad Fitzpatrick1-0/+5
Limit spamming GUIs with boring updates to once in 3 seconds, unless the notification is relatively interesting and the GUI should update immediately. This is basically @barnstar's #14119 but with the logic moved to be per-watch-session (since the bit is per session), rather than globally. And this distinguishes notable Notify messages (such as state changes) and makes them send immediately. Updates tailscale/corp#24553 Change-Id: I79cac52cce85280ce351e65e76ea11e107b00b49 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-15cmd/derpprobe,prober: add ability to restrict derpprobe to a single regionPercy Wegmann1-0/+4
Updates #24522 Co-authored-by: Mario Minardi <mario@tailscale.com> Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-11-13cmd/tailscale/cli: add "help" alias for --helpBrad Fitzpatrick2-2/+38
Fixes #14053 Change-Id: I0a13e11af089f02b0656fea0d316543c67591fb5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-12cmd/{k8s-operator,containerboot},k8s-operator: remove support for proxies ↵Irbe Krumina4-45/+9
below capver 95. (#13986) Updates tailscale/tailscale#13984 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-12cmd/k8s-operator: restart ProxyGroup pods less (#14045)Tom Proctor3-26/+66
We currently annotate pods with a hash of the tailscaled config so that we can trigger pod restarts whenever it changes. However, the hash updates more frequently than is necessary causing more restarts than is necessary. This commit removes two causes; scaling up/down and removing the auth key after pods have initially authed to control. However, note that pods will still restart on scale-up/down because of the updated set of volumes mounted into each pod. Hopefully we can fix that in a planned follow-up PR. Updates #13406 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2024-11-11all: use iterators over slice views moreBrad Fitzpatrick1-4/+4
This gets close to all of the remaining ones. Updates #12912 Change-Id: I9c672bbed2654a6c5cab31e0cbece6c107d8c6fa Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-11cmd/k8s-operator,k8s-operator,kube/kubetypes: add an option to configure app ↵Irbe Krumina7-38/+294
connector via Connector spec (#13950) * cmd/k8s-operator,k8s-operator,kube/kubetypes: add an option to configure app connector via Connector spec Updates tailscale/tailscale#11113 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-07derp/derphttp: don't link websockets other than on GOOS=jsBrad Fitzpatrick4-17/+2
Or unless the new "ts_debug_websockets" build tag is set. Updates #1278 Change-Id: Ic4c4f81c1924250efd025b055585faec37a5491d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-07control/controlhttp/controlhttpserver: split out Accept to its own packageBrad Fitzpatrick3-15/+18
Otherwise all the clients only using control/controlhttp for the ts2021 HTTP client were also pulling in WebSocket libraries, as the server side always needs to speak websockets, but only GOOS=js clients speak it. This doesn't yet totally remove the websocket dependency on Linux because Linux has a envknob opt-in to act like GOOS=js for manual testing and force the use of WebSockets for DERP only (not control). We can put that behind a build tag in a future change to eliminate the dep on all GOOSes. Updates #1278 Change-Id: I4f60508f4cad52bf8c8943c8851ecee506b7ebc9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-07cmd/tailscaled: support "ts_omit_ssh" build tag to remove SSHBrad Fitzpatrick2-1/+31
Some environments would like to remove Tailscale SSH support for the binary for various reasons when not needed (either for peace of mind, or the ~1MB of binary space savings). Updates tailscale/corp#24454 Updates #1278 Updates #12614 Change-Id: Iadd6c5a393992c254b5dc9aa9a526916f96fd07a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-07envknob,kube/kubetypes,cmd/k8s-operator: add app type for ProxyGroup (#14029)Irbe Krumina2-1/+6
Sets a custom hostinfo app type for ProxyGroup replicas, similarly to how we do it for all other Kubernetes Operator managed components. Updates tailscale/tailscale#13406,tailscale/corp#22920 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-06cmd/derper: show more information on home pagePercy Wegmann3-19/+92
- Basic description of DERP If configured to do so, also show - Mailto link to security@tailscale.com - Link to Tailscale Security Policies - Link to Tailscale Acceptable Use Policy Updates tailscale/corp#24092 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-11-05types/result, util/lineiter: add package for a result type, use itBrad Fitzpatrick5-5/+10
This adds a new generic result type (motivated by golang/go#70084) to try it out, and uses it in the new lineutil package (replacing the old lineread package), changing that package to return iterators: sometimes over []byte (when the input is all in memory), but sometimes iterators over results of []byte, if errors might happen at runtime. Updates #12912 Updates golang/go#70084 Change-Id: Iacdc1070e661b5fb163907b1e8b07ac7d51d3f83 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-04cmd/k8s-operator: allow to optionally configure tailscaled port (#14005)Irbe Krumina1-0/+8
Updates tailscale/tailscale#13981 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-03cmd/tsconnect: block after starting esbuild dev serverBrad Fitzpatrick1-0/+1
Thanks to @davidbuzz for raising the issue in #13973. Fixes #8272 Fixes #13973 Change-Id: Ic413e14d34c82df3c70a97e591b90316b0b4946b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-01wgengine/netstack: remove unused taildrive depsBrad Fitzpatrick2-3/+1
A filesystem was plumbed into netstack in 993acf4475b22d693 but hasn't been used since 2d5d6f5403f3. Remove it. Noticed while rebasing a Tailscale fork elsewhere. Updates tailscale/corp#16827 Change-Id: Ib76deeda205ffe912b77a59b9d22853ebff42813 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-31cmd/tailscale/cli, client/tailscale, ipn/localapi: add tailscale syspolicy ↵Nick Khyl4-2/+113
{list,reload} commands In this PR, we add the tailscale syspolicy command with two subcommands: list, which displays policy settings, and reload, which forces a reload of those settings. We also update the LocalAPI and LocalClient to facilitate these additions. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-30cmd/k8s-operator,k8s-operator: add topology spread constraints to ProxyClass ↵Irbe Krumina4-0/+366
(#13959) Now when we have HA for egress proxies, it makes sense to support topology spread constraints that would allow users to define more complex topologies of how proxy Pods need to be deployed in relation with other Pods/across regions etc. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-29cmd/tailscale/cli: add 'tailscale metrics' commandAnton Tolchanov2-0/+89
- `tailscale metrics print`: to show metric values in console - `tailscale metrics write`: to write metrics to a file (with a tempfile & rename dance, which is atomic on Unix). Also, remove the `TS_DEBUG_USER_METRICS` envknob as we are getting more confident in these metrics. Updates tailscale/corp#22075 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-10-26cmd/k8s-operator: validate that tailscale.com/tailnet-ip annotation value is ↵Nick Kirby2-3/+150
a valid IP Fixes #13836 Signed-off-by: Nick Kirby <nrkirb@gmail.com>
2024-10-25util/syspolicy, ipn/ipnlocal: update syspolicy package to utilize syspolicy/rsopNick Khyl4-14/+29
In this PR, we update the syspolicy package to utilize syspolicy/rsop under the hood, and remove syspolicy.CachingHandler, syspolicy.windowsHandler and related code which is no longer used. We mark the syspolicy.Handler interface and RegisterHandler/SetHandlerForTest functions as deprecated, but keep them temporarily until they are no longer used in other repos. We also update the package to register setting definitions for all existing policy settings and to register the Registry-based, Windows-specific policy stores when running on Windows. Finally, we update existing internal and external tests to use the new API and add a few more tests and benchmarks. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-24cmd/testwrapper: add pkg runtime to output (#13894)Paul Scott2-10/+21
Fixes #13893 Signed-off-by: Paul Scott <paul@tailscale.com>
2024-10-22net/netcheck: add a Now field to the netcheck ReportAndrew Dunham1-0/+1
This allows us to print the time that a netcheck was run, which is useful in debugging. Updates #10972 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id48d30d4eb6d5208efb2b1526a71d83fe7f9320b
2024-10-21net/tstun: restore tap mode functionalityMaisem Ali2-2/+2
It had bit-rotted likely during the transition to vector io in 76389d8baf942b10a8f0f4201b7c4b0737a0172c. Tested on Ubuntu 24.04 by creating a netns and doing the DHCP dance to get an IP. Updates #2589 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-10-21cmd/viewer: import types/views when generating a getter for a map fieldNick Khyl2-0/+79
Fixes #13873 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-20derp: track client-advertised non-ideal DERP connections in more placesBrad Fitzpatrick1-1/+1
In f77821fd63 (released in v1.72.0), we made the client tell a DERP server when the connection was not its ideal choice (the first node in its region). But we didn't do anything with that information until now. This adds a metric about how many such connections are on a given derper, and also adds a bit to the PeerPresentFlags bitmask so watchers can identify (and rebalance) them. Updates tailscale/corp#372 Change-Id: Ief8af448750aa6d598e5939a57c062f4e55962be Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-19net/tlsdial: call out firewalls blocking Tailscale in health warnings (#13840)Andrea Gottardo4-0/+4
Updates tailscale/tailscale#13839 Adds a new blockblame package which can detect common MITM SSL certificates used by network appliances. We use this in `tlsdial` to display a dedicated health warning when we cannot connect to control, and a network appliance MITM attack is detected. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2024-10-16cmd/tailscale,ipn,tailcfg: add `tailscale advertise` subcommand behind ↵Naman Sood4-2/+87
envknob (#13734) Signed-off-by: Naman Sood <mail@nsood.in>
2024-10-16ipn/ipnlocal: error when trying to use exit node on unsupported platform ↵Mario Minardi3-0/+3
(#13726) Adds logic to `checkExitNodePrefsLocked` to return an error when attempting to use exit nodes on a platform where this is not supported. This mirrors logic that was added to error out when trying to use `ssh` on an unsupported platform, and has very similar semantics. Fixes https://github.com/tailscale/tailscale/issues/13724 Signed-off-by: Mario Minardi <mario@tailscale.com>
2024-10-16cmd/tsconnect, logpolicy: fixes for wasm_js.goChristian1-0/+4
* updates to LocalBackend require metrics to be passed in which are now initialized * os.MkdirTemp isn't supported in wasm/js so we simply return empty string for logger * adds a UDP dialer which was missing and led to the dialer being incompletely initialized Fixes #10454 and #8272 Signed-off-by: Christian <christian@devzero.io>
2024-10-15cmd/derpprobe: add /healthz endpointAndrew Dunham1-0/+5
For a customer that wants to run their own DERP prober, let's add a /healthz endpoint that can be used to monitor derpprobe itself. Updates #6526 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Iba315c999fc0b1a93d8c503c07cc733b4c8d5b6b
2024-10-11client/tailscale,cmd/{cli,get-authkey,k8s-operator}: set distinct User-AgentsPercy Wegmann3-0/+3
This helps better distinguish what is generating activity to the Tailscale public API. Updates tailscale/corp#23838 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-10-10clientupdate: don't link distsign on platforms that don't downloadBrad Fitzpatrick3-3/+3
Updates tailscale/corp#20099 Change-Id: Ie3b782379b19d5f7890a8d3a378096b4f3e8a612 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-09clientupdate, ipn/localapi: don't use google/uuid, thin iOS depsBrad Fitzpatrick2-5/+5
We were using google/uuid in two places and that brought in database/sql/driver. We didn't need it in either place. Updates #13760 Updates tailscale/corp#20099 Change-Id: Ieed32f1bebe35d35f47ec5a2a429268f24f11f1f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-09cmd/k8s-operator,k8s-operator/apis: set a readiness condition on egress ↵Irbe Krumina4-6/+407
Services for ProxyGroup (#13746) cmd/k8s-operator,k8s-operator/apis: set a readiness condition on egress Services Set a readiness condition on ExternalName Services that define a tailnet target to route cluster traffic to via a ProxyGroup's proxies. The condition is set to true if at least one proxy is currently set up to route. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-09cmd/k8s-operator: don't error out if ProxyClass for ProxyGroup not found. ↵Irbe Krumina1-1/+8
(#13736) We don't need to error out and continuously reconcile if ProxyClass has not (yet) been created, once it gets created the ProxyGroup reconciler will get triggered. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-09cmd/k8s-operator: fix Pod IP selection (#13743)Irbe Krumina2-2/+6
Ensure that .status.podIPs is used to select Pod's IP in all reconcilers. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-08util/syspolicy, ipn: add "tailscale debug component-logs" supportNick Khyl4-4/+8
Fixes #13313 Fixes #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2024-10-08cmd/k8s-operator: base ProxyGroup StatefulSet on common proxy.yaml ↵Tom Proctor3-148/+144
definition (#13714) As discussed in #13684, base the ProxyGroup's proxy definitions on the same scaffolding as the existing proxies, as defined in proxy.yaml Updates #13406 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2024-10-08cmd/{k8s-operator,containerboot},kube/egressservices: fix Pod IP check for ↵Irbe Krumina6-44/+108
dual stack clusters (#13721) Currently egress Services for ProxyGroup only work for Pods and Services with IPv4 addresses. Ensure that it works on dual stack clusters by reading proxy Pod's IP from the .status.podIPs list that always contains both IPv4 and IPv6 address (if the Pod has them) rather than .status.podIP that could contain IPv6 only for a dual stack cluster. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-08cmd/k8s-operator,k8s-operator: use default ProxyClass if set for ProxyGroup ↵Tom Proctor13-64/+112
(#13720) The default ProxyClass can be set via helm chart or env var, and applies to all proxies that do not otherwise have an explicit ProxyClass set. This ensures proxies created by the new ProxyGroup CRD are consistent with the behaviour of existing proxies Nearby but unrelated changes: * Fix up double error logs (controller runtime logs returned errors) * Fix a couple of variable names Updates #13406 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2024-10-08cmd/containerboot: simplify k8s setup logic (#13627)Tom Proctor1-29/+36
Rearrange conditionals to reduce indentation and make it a bit easier to read the logic. Also makes some error message updates for better consistency with the recent decision around capitalising resource names and the upcoming addition of config secrets. Updates #cleanup Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2024-10-07cmd/k8s-operator,k8s-operator: create ConfigMap for egress services + small ↵Irbe Krumina11-67/+151
fixes for egress services (#13715) cmd/k8s-operator, k8s-operator: create ConfigMap for egress services + small reconciler fixes Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-07types/key: use tlpub: in error message (#13707)Erisa A1-1/+1
Fixes tailscale/corp#19442 Signed-off-by: Erisa A <erisa@tailscale.com>
2024-10-07cmd/{containerboot,k8s-operator},k8s-operator,kube: add ProxyGroup ↵Tom Proctor14-25/+1101
controller (#13684) Implements the controller for the new ProxyGroup CRD, designed for running proxies in a high availability configuration. Each proxy gets its own config and state Secret, and its own tailscale node ID. We are currently mounting all of the config secrets into the container, but will stop mounting them and instead read them directly from the kube API once #13578 is implemented. Updates #13406 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2024-10-04cmd/tailscale/cli: don't print disablement secrets if init fails (#13673)Erisa A1-3/+6
* cmd/tailscale/cli: don't print disablement secrets if init fails Fixes tailscale/corp#11355 Signed-off-by: Erisa A <erisa@tailscale.com> * cmd/tailscale/cli: changes from code review Signed-off-by: Erisa A <erisa@tailscale.com> * cmd/tailscale/cli: small grammar change Signed-off-by: Erisa A <erisa@tailscale.com> --------- Signed-off-by: Erisa A <erisa@tailscale.com>
2024-10-04cmd/{k8s-operator,containerboot},k8s-operator,kube: reconcile ExternalName ↵Irbe Krumina12-14/+1584
Services for ProxyGroup (#13635) Adds a new reconciler that reconciles ExternalName Services that define a tailnet target that should be exposed to cluster workloads on a ProxyGroup's proxies. The reconciler ensures that for each such service, the config mounted to the proxies is updated with the tailnet target definition and that and EndpointSlice and ClusterIP Service are created for the service. Adds a new reconciler that ensures that as proxy Pods become ready to route traffic to a tailnet target, the EndpointSlice for the target is updated with the Pods' endpoints. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-03cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, ↵Irbe Krumina3-4/+7
clean up if needed (#13658) The AddSNATRuleForDst rule was adding a new rule each time it was called including: - if a rule already existed - if a rule matching the destination, but with different desired source already existed This was causing issues especially for the in-progress egress HA proxies work, where the rules are now refreshed more frequently, so more redundant rules were being created. This change: - only creates the rule if it doesn't already exist - if a rule for the same dst, but different source is found, delete it - also ensures that egress proxies refresh firewall rules if the node's tailnet IP changes Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-01cmd/tailscale/cli: make 'tailscale debug ts2021' try twiceBrad Fitzpatrick1-5/+20
In prep for a future port 80 MITM fix, make the 'debug ts2021' command retry once after a failure to give it a chance to pick a new strategy. Updates #13597 Change-Id: Icb7bad60cbf0dbec78097df4a00e9795757bc8e4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.