tailscale/util/linuxfw
Irbe Krumina 3af0f526b8
cmd{containerboot,k8s-operator},util/linuxfw: support ExternalName Services (#11802)
* cmd/containerboot,util/linuxfw: support proxy backends specified by DNS name

Adds support for optionally configuring containerboot to proxy
traffic to backends configured by passing TS_EXPERIMENTAL_DEST_DNS_NAME env var
to containerboot.
Containerboot will periodically (every 10 minutes) attempt to resolve
the DNS name and ensure that all traffic sent to the node's
tailnet IP gets forwarded to the resolved backend IP addresses.

Currently:
- if the firewall mode is iptables, traffic will be load balanced
accross the backend IP addresses using round robin. There are
no health checks for whether the IPs are reachable.
- if the firewall mode is nftables traffic will only be forwarded
to the first IP address in the list. This is to be improved.

* cmd/k8s-operator: support ExternalName Services

 Adds support for exposing endpoints, accessible from within
a cluster to the tailnet via DNS names using ExternalName Services.
This can be done by annotating the ExternalName Service with
tailscale.com/expose: "true" annotation.
The operator will deploy a proxy configured to route tailnet
traffic to the backend IPs that service.spec.externalName
resolves to. The backend IPs must be reachable from the operator's
namespace.

Updates tailscale/tailscale#10606

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-04-23 17:30:00 +01:00
..
linuxfwtest util/linuxfw: initial implementation of package 2023-02-09 14:20:24 -05:00
detector.go linuxfw,wgengine/route,ipn: add c2n and nodeattrs to control linux netfilter 2023-12-05 14:22:02 -05:00
fake.go util/linuxfw,wgengine/router: skip IPv6 firewall configuration in partial iptables mode (#11546) 2024-03-29 05:23:03 +00:00
helpers.go all: cleanup unused code, part 2 (#10670) 2023-12-21 17:40:03 -08:00
iptables.go util/linuxfw: move detection logic 2023-10-10 20:29:24 -07:00
iptables_runner.go cmd{containerboot,k8s-operator},util/linuxfw: support ExternalName Services (#11802) 2024-04-23 17:30:00 +01:00
iptables_runner_test.go util/linuxfw: move fake runner into pkg 2023-10-11 11:48:43 -07:00
linuxfw.go util/linuxfw,wgengine/router: enable IPv6 configuration when netfilter is disabled 2024-03-21 16:10:47 -07:00
linuxfw_unsupported.go all: cleanup unused code, part 2 (#10670) 2023-12-21 17:40:03 -08:00
nftables.go util/cmpx: delete now that we're using Go 1.22 2024-02-07 18:10:15 -08:00
nftables_runner.go cmd{containerboot,k8s-operator},util/linuxfw: support ExternalName Services (#11802) 2024-04-23 17:30:00 +01:00
nftables_runner_test.go util/linuxfw: add missing error checks in tests 2023-10-28 09:44:53 -07:00
nftables_types.go util/linuxfw: add new arch build constraints 2023-06-30 18:22:15 -04:00