Repository navigation
cmd/tail-watch,examples,openspec: run tail-watch as a ProxyGroup sidecar - #9
Merged
Merged
Conversation
An ingress ProxyGroup keeps a Tailscale Service advertised while the path from the proxy pod to the workload is broken: the operator gates advertising on EndpointSlice readiness, which is the kubelet's view from the workload's node, not reachability from the proxy. Add collector.local_only, which runs the collector with no tailscaled. Targets default to network local; tailnet targets, tsping and the UI are rejected; startup skips the LocalAPI preflight, presence, resolver and learner, and takes its identity from the hostname. notify-test honours it too. That lets tail-watch run as an opt-in sidecar in the proxy pods and probe hop 2 from their own network namespace. Ship four injection methods (MutatingAdmissionPolicy, Kyverno, an example webhook handler, and freeze-and-patch for evaluation). Each selects pods by the operator's ProxyGroup label plus a tail-watch/inject label from a ProxyClass, and names the ConfigMap and Secret after the pod's ProxyGroup. TestSidecarCopiesAgree keeps the embedded copies in step with examples/kubernetes/sidecar.yaml. TestKindProxyGroup, gated on TAIL_WATCH_KIND=1, runs the how-to's blocks on a kind cluster with the operator and breaks hop 2 with a NetworkPolicy and a wrong readiness port while the Service stays advertised. The tailnet API key in the stack scripts now reaches curl through a config on a pipe instead of its command line. Signed-off-by: Richard Shade <rshade98@hotmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An ingress ProxyGroup keeps a Tailscale Service advertised while the path from the proxy pod to the workload is broken: the operator gates advertising on EndpointSlice readiness, which is the kubelet's view from the workload's node, not reachability from the proxy.
Add collector.local_only, which runs the collector with no tailscaled. Targets default to network local; tailnet targets, tsping and the UI are rejected; startup skips the LocalAPI preflight, presence, resolver and learner, and takes its identity from the hostname. notify-test honours it too. That lets tail-watch run as an opt-in sidecar in the proxy pods and probe hop 2 from their own network namespace.
Ship four injection methods (MutatingAdmissionPolicy, Kyverno, an example webhook handler, and freeze-and-patch for evaluation). Each selects pods by the operator's ProxyGroup label plus a tail-watch/inject label from a ProxyClass, and names the ConfigMap and Secret after the pod's ProxyGroup. TestSidecarCopiesAgree keeps the embedded copies in step with examples/kubernetes/sidecar.yaml. TestKindProxyGroup, gated on TAIL_WATCH_KIND=1, runs the how-to's blocks on a kind cluster with the operator and breaks hop 2 with a NetworkPolicy and a wrong readiness port while the Service stays advertised.
The tailnet API key in the stack scripts now reaches curl through a config on a pipe instead of its command line.