Repository navigation
Update tailscale to v1.104.1 - #364
Merged
Merged
Conversation
Argo CD Diff PreviewSummary: Modified (1):
± sandbox-oci-tailscale (+76|-31)sandbox-oci-tailscale (applications/appset-ops-tools.yaml)Deployment: tailscale/operator - name: CLIENT_SECRET_FILE
value: /oauth/client_secret
- name: PROXY_IMAGE
- value: docker.io/tailscale/tailscale:v1.102.4
+ value: docker.io/tailscale/tailscale:v1.104.1
- name: PROXY_TAGS
value: tag:k8s
- name: APISERVER_PROXY
@@ skipped 8 lines (49 -> 56) @@
valueFrom:
fieldRef:
fieldPath: metadata.uid
- image: docker.io/tailscale/k8s-operator:v1.102.4
+ - name: OPERATOR_SHARED_ACME_ACCOUNT_KEY
+ value: "false"
+ image: docker.io/tailscale/k8s-operator:v1.104.1
imagePullPolicy: Always
name: operator
resources:CustomResourceDefinition: connectors.tailscale.com kind: CustomResourceDefinition
metadata:
annotations:
- controller-gen.kubebuilder.io/version: v0.17.0
+ controller-gen.kubebuilder.io/version: v0.22.0
name: connectors.tailscale.com
spec:
group: tailscale.comCustomResourceDefinition: dnsconfigs.tailscale.com kind: CustomResourceDefinition
metadata:
annotations:
- controller-gen.kubebuilder.io/version: v0.17.0
+ controller-gen.kubebuilder.io/version: v0.22.0
name: dnsconfigs.tailscale.com
spec:
group: tailscale.com
@@ skipped 42 lines (9 -> 50) @@
NB: if you want cluster workloads to be able to refer to Tailscale Ingress
using its MagicDNS name, you must also annotate the Ingress resource with
tailscale.com/experimental-forward-cluster-traffic-via-ingress annotation to
- ensure that the proxy created for the Ingress listens on its Pod IP address.
+ ensure that the proxy created for the Ingress is available via its Pod IP
+ address. The annotation installs rules that DNAT traffic sent to the proxy's
+ Pod IP to its Tailscale IP, and allows the Serve listener on that Tailscale IP
+ to accept packets arriving through the Pod interface. Traffic accepted via this
+ path does not traverse the Tailscale tunnel and is not affected by tailnet
+ ACLs. Restrict access using Kubernetes network policy.
properties:
apiVersion:
description: |-
@@ skipped 963 lines (64 -> 1026) @@
x-kubernetes-list-type: atomic
type: object
type: object
+ imagePullSecrets:
+ description: |-
+ Nameserver Pod's image pull Secrets.
+ https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec
+ items:
+ description: |-
+ LocalObjectReference contains enough information to let you locate the
+ referenced object inside the same namespace.
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
nodeSelector:
additionalProperties:
type: string
@@ skipped 21 lines (1054 -> 1074) @@
operator:
description: |-
Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-CustomResourceDefinition: peerrelays.tailscale.com kind: CustomResourceDefinition
metadata:
annotations:
- controller-gen.kubebuilder.io/version: v0.17.0
+ controller-gen.kubebuilder.io/version: v0.22.0
name: peerrelays.tailscale.com
spec:
group: tailscale.com
@@ skipped 149 lines (9 -> 157) @@
Annotations to apply to the LoadBalancer service. Any annotations that conflict with those used by known
cloud providers to ensure IP addresses rather than DNS names are ignored.
type: object
+ port:
+ default: 41641
+ description: |-
+ Port is the UDP port each peer relay replica listens on and that its LoadBalancer Service exposes
+ externally. The two are always equal: the relay advertises address:port to peers, so the load balancer
+ must forward without rewriting the port. Changing the port on an existing PeerRelay briefly interrupts
+ relay traffic while the load balancer updates. Defaults to 41641.
+ maximum: 65535
+ minimum: 1
+ type: integer
type: object
+ staticEndpoints:
+ description: |-
+ StaticEndpoints is an optional list of address:port pairs on which every replica of this PeerRelay is
+ reachable from outside the cluster, for example the public side of a NAT or firewall in front of the
+ cluster. These supplement the endpoints discovered from each replica's LoadBalancer Service: they are
+ added to every replica's entries in status.endpoints and advertised to peers alongside them. If an entry
+ names an address a replica's load balancer already provides, the entry's port takes precedence for that
+ address. Each address may appear at most once across all entries.
+ Entries take the form accepted by Go's net/netip.ParseAddrPort, e.g. 203.0.113.1:41641. IPv6
+ addresses must be enclosed in brackets, e.g. [2001:db8::1]:41641.
+ items:
+ pattern: ^(\d{1,3}(\.\d{1,3}){3}|\[[0-9a-fA-F:.]+\]):\d{1,5}$
+ type: string
+ type: array
+ x-kubernetes-list-type: set
tags:
description: |-
Tags that the Tailscale node will be tagged with.
@@ skipped 92 lines (190 -> 281) @@
Endpoints lists the public address:port pairs each peer relay replica is reachable on. Entries appear as the
underlying cloud provisions each Service. A replica has one entry per address its LoadBalancer Service was
given, which is usually one, but a load balancer spanning several availability zones has an address in each
- and every one of them is listed.
+ and every one of them is listed. Entries from spec.staticEndpoints are listed for every replica in addition
+ to the load balancer addresses.
items:
properties:
address:
description: |-
- Address is the public IP or hostname the cloud has allocated for this replica's LoadBalancer Service.
- Peers reach this relay by connecting to Address:Port over UDP.
+ Address is the public IP or hostname the cloud has allocated for this replica's LoadBalancer Service, or
+ an address supplied via spec.staticEndpoints. Peers reach this relay by connecting to Address:Port over UDP.
type: string
port:
description: Port is the UDP port the peer relay listens on.
@@ skipped 16 lines (299 -> 314) @@
x-kubernetes-list-type: map
type: object
required:
- - metadata
- spec
type: object
served: trueCustomResourceDefinition: proxyclasses.tailscale.com kind: CustomResourceDefinition
metadata:
annotations:
- controller-gen.kubebuilder.io/version: v0.17.0
+ controller-gen.kubebuilder.io/version: v0.22.0
name: proxyclasses.tailscale.com
spec:
group: tailscale.com
@@ skipped 1286 lines (9 -> 1294) @@
Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
CSIDriver instance. Other volumes are always re-labelled recursively.
- "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
- If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
- If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
- and "Recursive" for all other volumes.
+ If not specified, "MountOption" is used.
This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
@@ skipped 356 lines (1307 -> 1662) @@
procMount denotes the type of proc mount to use for the containers.
The default value is Default which uses the container runtime defaults for
readonly paths and masked paths.
- This requires the ProcMountType feature flag to be enabled.
Note that this field cannot be set when spec.os.name is windows.
type: string
readOnlyRootFilesystem:
@@ skipped 343 lines (1670 -> 2012) @@
procMount denotes the type of proc mount to use for the containers.
The default value is Default which uses the container runtime defaults for
readonly paths and masked paths.
- This requires the ProcMountType feature flag to be enabled.
Note that this field cannot be set when spec.os.name is windows.
type: string
readOnlyRootFilesystem:
@@ skipped 138 lines (2020 -> 2157) @@
operator:
description: |-
Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-CustomResourceDefinition: proxygrouppolicies.tailscale.com kind: CustomResourceDefinition
metadata:
annotations:
- controller-gen.kubebuilder.io/version: v0.17.0
+ controller-gen.kubebuilder.io/version: v0.22.0
name: proxygrouppolicies.tailscale.com
spec:
group: tailscale.com
@@ skipped 118 lines (9 -> 126) @@
x-kubernetes-list-type: map
type: object
required:
- - metadata
- spec
type: object
served: trueCustomResourceDefinition: proxygroups.tailscale.com kind: CustomResourceDefinition
metadata:
annotations:
- controller-gen.kubebuilder.io/version: v0.17.0
+ controller-gen.kubebuilder.io/version: v0.22.0
name: proxygroups.tailscale.com
spec:
group: tailscale.comCustomResourceDefinition: recorders.tailscale.com kind: CustomResourceDefinition
metadata:
annotations:
- controller-gen.kubebuilder.io/version: v0.17.0
+ controller-gen.kubebuilder.io/version: v0.22.0
name: recorders.tailscale.com
spec:
group: tailscale.com
@@ skipped 1215 lines (9 -> 1223) @@
procMount denotes the type of proc mount to use for the containers.
The default value is Default which uses the container runtime defaults for
readonly paths and masked paths.
- This requires the ProcMountType feature flag to be enabled.
Note that this field cannot be set when spec.os.name is windows.
type: string
readOnlyRootFilesystem:
@@ skipped 248 lines (1231 -> 1478) @@
Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
CSIDriver instance. Other volumes are always re-labelled recursively.
- "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
- If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
- If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
- and "Recursive" for all other volumes.
+ If not specified, "MountOption" is used.
This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
@@ skipped 181 lines (1491 -> 1671) @@
operator:
description: |-
Operator represents a key's relationship to the value.
- Valid operators are Exists and Equal. Defaults to Equal.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-CustomResourceDefinition: tailnets.tailscale.com kind: CustomResourceDefinition
metadata:
annotations:
- controller-gen.kubebuilder.io/version: v0.17.0
+ controller-gen.kubebuilder.io/version: v0.22.0
name: tailnets.tailscale.com
spec:
group: tailscale.com
@@ skipped 129 lines (9 -> 137) @@
x-kubernetes-list-type: map
type: object
required:
- - metadata
- spec
type: object
served: trueStats: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.102.5→v1.104.11.102.4→1.104.1Release Notes
tailscale/tailscale (docker.io/tailscale/tailscale)
v1.104.1Compare Source
Please refer to the changelog available at https://tailscale.com/changelog
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.