Merge tag 'v1.66.3' into sunos-1.66

Release 1.66.3

VERSION.txt

@@ -1 +1 @@
-1.66.1
+1.66.3

cmd/containerboot/main.go

@@ -52,8 +52,10 @@
 // ${TS_CERT_DOMAIN}, it will be replaced with the value of the available FQDN.
 // It cannot be used in conjunction with TS_DEST_IP. The file is watched for changes,
 // and will be re-applied when it changes.
-// - EXPERIMENTAL_TS_CONFIGFILE_PATH: if specified, a path to tailscaled
-// config. If this is set, TS_HOSTNAME, TS_EXTRA_ARGS, TS_AUTHKEY,
+// - TS_EXPERIMENTAL_VERSIONED_CONFIG_DIR: if specified, a path to a
+// directory that containers tailscaled config in file. The config file needs to be
+// named cap-<current-tailscaled-cap>.hujson. If this is set, TS_HOSTNAME,
+// TS_EXTRA_ARGS, TS_AUTHKEY,
 // TS_ROUTES, TS_ACCEPT_DNS env vars must not be set. If this is set,
 // containerboot only runs `tailscaled --config <path-to-this-configfile>`
 // and not `tailscale up` or `tailscale set`.
@@ -92,6 +94,7 @@ import (
  "os"
  "os/exec"
  "os/signal"
+ "path"
  "path/filepath"
  "reflect"
  "slices"
@@ -107,6 +110,7 @@ import (
  "tailscale.com/client/tailscale"
  "tailscale.com/ipn"
  "tailscale.com/ipn/conffile"
+ kubeutils "tailscale.com/k8s-operator"
  "tailscale.com/tailcfg"
  "tailscale.com/types/logger"
  "tailscale.com/types/ptr"
@@ -145,7 +149,7 @@ func main() {
  Socket: defaultEnv("TS_SOCKET", "/tmp/tailscaled.sock"),
  AuthOnce: defaultBool("TS_AUTH_ONCE", false),
  Root: defaultEnv("TS_TEST_ONLY_ROOT", "/"),
- TailscaledConfigFilePath: defaultEnv("EXPERIMENTAL_TS_CONFIGFILE_PATH", ""),
+ TailscaledConfigFilePath: tailscaledConfigFilePath(),
  AllowProxyingClusterTrafficViaIngress: defaultBool("EXPERIMENTAL_ALLOW_PROXYING_CLUSTER_TRAFFIC_VIA_INGRESS", false),
  PodIP: defaultEnv("POD_IP", ""),
  }
@@ -1097,6 +1101,13 @@ type settings struct {
 
 func (s *settings) validate() error {
  if s.TailscaledConfigFilePath != "" {
+ dir, file := path.Split(s.TailscaledConfigFilePath)
+ if _, err := os.Stat(dir); err != nil {
+ return fmt.Errorf("error validating whether directory with tailscaled config file %s exists: %w", dir, err)
+ }
+ if _, err := os.Stat(s.TailscaledConfigFilePath); err != nil {
+ return fmt.Errorf("error validating whether tailscaled config directory %q contains tailscaled config for current capability version %q: %w. If this is a Tailscale Kubernetes operator proxy, please ensure that the version of the operator is not older than the version of the proxy", dir, file, err)
+ }
  if _, err := conffile.Load(s.TailscaledConfigFilePath); err != nil {
  return fmt.Errorf("error validating tailscaled configfile contents: %w", err)
  }
@@ -1120,7 +1131,7 @@ func (s *settings) validate() error {
  return errors.New("Both TS_TAILNET_TARGET_IP and TS_TAILNET_FQDN cannot be set")
  }
  if s.TailscaledConfigFilePath != "" && (s.AcceptDNS != nil || s.AuthKey != "" || s.Routes != nil || s.ExtraArgs != "" || s.Hostname != "") {
- return errors.New("EXPERIMENTAL_TS_CONFIGFILE_PATH cannot be set in combination with TS_HOSTNAME, TS_EXTRA_ARGS, TS_AUTHKEY, TS_ROUTES, TS_ACCEPT_DNS.")
+ return errors.New("TS_EXPERIMENTAL_VERSIONED_CONFIG_DIR cannot be set in combination with TS_HOSTNAME, TS_EXTRA_ARGS, TS_AUTHKEY, TS_ROUTES, TS_ACCEPT_DNS.")
  }
  if s.AllowProxyingClusterTrafficViaIngress && s.UserspaceMode {
  return errors.New("EXPERIMENTAL_ALLOW_PROXYING_CLUSTER_TRAFFIC_VIA_INGRESS is not supported in userspace mode")
@@ -1252,3 +1263,42 @@ func isTwoStepConfigAlwaysAuth(cfg *settings) bool {
 func isOneStepConfig(cfg *settings) bool {
  return cfg.TailscaledConfigFilePath != ""
 }
+
+// tailscaledConfigFilePath returns the path to the tailscaled config file that
+// should be used for the current capability version. It is determined by the
+// TS_EXPERIMENTAL_VERSIONED_CONFIG_DIR environment variable and looks for a
+// file named cap-<capability_version>.hujson in the directory. It searches for
+// the highest capability version that is less than or equal to the current
+// capability version.
+func tailscaledConfigFilePath() string {
+ dir := os.Getenv("TS_EXPERIMENTAL_VERSIONED_CONFIG_DIR")
+ if dir == "" {
+ return ""
+ }
+ fe, err := os.ReadDir(dir)
+ if err != nil {
+ log.Fatalf("error reading tailscaled config directory %q: %v", dir, err)
+ }
+ maxCompatVer := tailcfg.CapabilityVersion(-1)
+ for _, e := range fe {
+ // We don't check if type if file as in most cases this will
+ // come from a mounted kube Secret, where the directory contents
+ // will be various symlinks.
+ if e.Type().IsDir() {
+ continue
+ }
+ cv, err := kubeutils.CapVerFromFileName(e.Name())
+ if err != nil {
+ log.Printf("skipping file %q in tailscaled config directory %q: %v", e.Name(), dir, err)
+ continue
+ }
+ if cv > maxCompatVer && cv <= tailcfg.CurrentCapabilityVersion {
+ maxCompatVer = cv
+ }
+ }
+ if maxCompatVer == -1 {
+ log.Fatalf("no tailscaled config file found in %q for current capability version %q", dir, tailcfg.CurrentCapabilityVersion)
+ }
+ log.Printf("Using tailscaled config file %q for capability version %q", maxCompatVer, tailcfg.CurrentCapabilityVersion)
+ return path.Join(dir, kubeutils.TailscaledConfigFileNameForCap(maxCompatVer))
+}

cmd/containerboot/main_test.go

@@ -65,7 +65,7 @@ func TestContainerBoot(t *testing.T) {
  "dev/net",
  "proc/sys/net/ipv4",
  "proc/sys/net/ipv6/conf/all",
- "etc",
+ "etc/tailscaled",
  }
  for _, path := range dirs {
  if err := os.MkdirAll(filepath.Join(d, path), 0700); err != nil {
@@ -80,7 +80,7 @@ func TestContainerBoot(t *testing.T) {
  "dev/net/tun": []byte(""),
  "proc/sys/net/ipv4/ip_forward": []byte("0"),
  "proc/sys/net/ipv6/conf/all/forwarding": []byte("0"),
- "etc/tailscaled":  tailscaledConfBytes,
+ "etc/tailscaled/cap-95.hujson": tailscaledConfBytes,
  }
  resetFiles := func() {
  for path, content := range files {
@@ -638,14 +638,14 @@ func TestContainerBoot(t *testing.T) {
  },
  },
  {
- Name: "experimental tailscaled configfile",
+ Name: "experimental tailscaled config path",
  Env: map[string]string{
- "EXPERIMENTAL_TS_CONFIGFILE_PATH": filepath.Join(d, "etc/tailscaled"),
+ "TS_EXPERIMENTAL_VERSIONED_CONFIG_DIR": filepath.Join(d, "etc/tailscaled/"),
  },
  Phases: []phase{
  {
  WantCmds: []string{
- "/usr/bin/tailscaled --socket=/tmp/tailscaled.sock --state=mem: --statedir=/tmp --tun=userspace-networking --config=/etc/tailscaled",
+ "/usr/bin/tailscaled --socket=/tmp/tailscaled.sock --state=mem: --statedir=/tmp --tun=userspace-networking --config=/etc/tailscaled/cap-95.hujson",
  },
  }, {
  Notify: runningNotify,

cmd/k8s-operator/operator_test.go

@@ -1182,7 +1182,7 @@ func TestTailscaledConfigfileHash(t *testing.T) {
  parentType: "svc",
  hostname: "default-test",
  clusterTargetIP: "10.20.30.40",
- confFileHash: "705e5ffd0bd5326237efdf542c850a65a54101284d5daa30775420fcc64d89c1",
+ confFileHash: "e09bededa0379920141cbd0b0dbdf9b8b66545877f9e8397423f5ce3e1ba439e",
  }
  expectEqual(t, fc, expectedSTS(t, fc, o), nil)
 
@@ -1192,7 +1192,7 @@ func TestTailscaledConfigfileHash(t *testing.T) {
  mak.Set(&svc.Annotations, AnnotationHostname, "another-test")
  })
  o.hostname = "another-test"
- o.confFileHash = "1a087f887825d2b75d3673c7c2b0131f8ec1f0b1cb761d33e236dd28350dfe23"
+ o.confFileHash = "5d754cf55463135ee34aa9821f2fd8483b53eb0570c3740c84a086304f427684"
  expectReconciled(t, sr, "default", "test")
  expectEqual(t, fc, expectedSTS(t, fc, o), nil)
 }