mirror of
https://github.com/tailscale/tailscale.git
synced 2026-07-20 21:23:07 +08:00
6ee7bcb458
* cmd/{k8s-operator,containerboot,k8s-proxy},kube: support IPv6 in egress ProxyGroup
Add support for dual-stack and IPv6 clusters in egress ProxyGroup.
Previously, egress ProxyGroup only supported IPv4: the operator and
containerboot assumed IPv4 for ClusterIP Services, EndpointSlices,
and health check headers.
This change introduces the following:
- Create a per-family EndpointSlice instead of a single IPv4
EndpointSlice.
- Update the egress services readiness reconciler to account for
both IPv4 and IPv6 EndpointSlices.
- Update the pod readiness reconciler to use the primary Pod IP
(PodIPs[0]) for readiness checks, instead of hard-coding to use
IPv4.
- Update the /healthz handler to return both PodIPv4Header and
PodIPv6Header.
- Add an IPv6 address field to egress status.
- Update containerboot and k8s-proxy to use the new health check
logic.
Updates tailscale/corp#41677
Change-Id: If66a3146df48c75b1e65a71632bbc9fc75feded2
Signed-off-by: Becky Pauley <becky@tailscale.com>
* cmd/{k8s-operator,containerboot}: improve dual-stack egress ProxyGroup
On dual-stack clusters, an egress ProxyGroup Service has one EndpointSlice
per IP family (IPv4 and IPv6). However, EndpointSlices were only recreated
when the ExternalName Service configuration changed, so a deleted
EndpointSlice was not recreated. The egress readiness reconciler also had
no mechanism to identify which IP families should exist (previously only
an IPv4 EndpoitSlice was required).
We now create an EndpointSlice for every IP family the ClusterIP Service
supports.
Also mark an egress Service NotReady when an EndpointSlice for an expected IP
family (derived from the Service's ClusterIPs) is missing, so a
dual-stack Service missing a family's EndpointSlice is no longer reported
Ready.
Clarify that the egress pre-shutdown and Pod readiness health checks
verify only one IP family on dual-stack clusters.
Change-Id: I35b03daf76ac817cd516e9a731770b2d85f6ee16
Signed-off-by: Becky Pauley <becky@tailscale.com>
---------
Signed-off-by: Becky Pauley <becky@tailscale.com>
|
||
|---|---|---|
| .. | ||
| addlicense | ||
| build-webclient | ||
| checkmetrics | ||
| cigocacher | ||
| cloner | ||
| connector-gen | ||
| containerboot | ||
| derper | ||
| derpprobe | ||
| dist | ||
| distsign | ||
| fbstatus | ||
| featuretags | ||
| get-authkey | ||
| gitops-pusher | ||
| hello | ||
| jsonimports | ||
| k8s-nameserver | ||
| k8s-operator | ||
| k8s-proxy | ||
| mkmanifest | ||
| mkpkg | ||
| mkversion | ||
| nardump | ||
| natc | ||
| netlogfmt | ||
| nginx-auth | ||
| omitsize | ||
| pgproxy | ||
| printdep | ||
| proxy-test-server | ||
| proxy-to-grafana | ||
| sniproxy | ||
| speedtest | ||
| ssh-auth-none-demo | ||
| stunc | ||
| stund | ||
| stunstamp | ||
| sync-containers | ||
| systray | ||
| tailscale | ||
| tailscaled | ||
| testcontrol | ||
| testwrapper | ||
| tl-longchain | ||
| tsconnect | ||
| tsidp | ||
| tsnet-proxy | ||
| tsp | ||
| tsshd | ||
| tta | ||
| vet | ||
| viewer | ||
| vnet | ||
| xdpderper | ||