Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 3b55bf9

Browse files
Maisem Alimaisem
Maisem Ali
authored and
maisem
committed
build_docker.sh: add run.sh as an entrypoint to the docker image
Fixes tailscale#4071 Signed-off-by: Maisem Ali <[email protected]>
1 parent bf2fa7b commit 3b55bf9

11 files changed

+75
-87
lines changed

‎build_docker.sh

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,9 @@ go run github.com/tailscale/mkctr \
4040
-X tailscale.com/version.Long=${VERSION_LONG} \
4141
-X tailscale.com/version.Short=${VERSION_SHORT} \
4242
-X tailscale.com/version.GitCommit=${VERSION_GIT_HASH}" \
43+
--files="docs/k8s/run.sh:/tailscale/run.sh" \
4344
--base="${BASE}" \
4445
--tags="${TAGS}" \
4546
--repos="${REPOS}" \
46-
--push="${PUSH}"
47+
--push="${PUSH}" \
48+
/bin/sh /tailscale/run.sh

‎docs/k8s/Dockerfile

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎docs/k8s/Makefile

Lines changed: 7 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,28 @@
1-
# Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
1+
# Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
22
# Use of this source code is governed by a BSD-style
33
# license that can be found in the LICENSE file.
44

5-
ifndef IMAGE_TAG
6-
$(error "IMAGE_TAG is not set")
7-
endif
8-
95
ROUTES ?= ""
106
SA_NAME ?= tailscale
117
KUBE_SECRET ?= tailscale
128

13-
build:
14-
@docker build . -t $(IMAGE_TAG)
15-
16-
push: build
17-
@docker push $(IMAGE_TAG)
18-
199
rbac:
20-
@sed -e "s;{{KUBE_SECRET}};$(KUBE_SECRET);g" role.yaml | kubectl apply -f -
10+
@sed -e "s;{{TS_KUBE_SECRET}};$(TS_KUBE_SECRET);g" role.yaml | kubectl apply -f -
2111
@sed -e "s;{{SA_NAME}};$(SA_NAME);g" rolebinding.yaml | kubectl apply -f -
2212
@sed -e "s;{{SA_NAME}};$(SA_NAME);g" sa.yaml | kubectl apply -f -
2313

2414
sidecar:
2515
@kubectl delete -f sidecar.yaml --ignore-not-found --grace-period=0
26-
@sed -e "s;{{KUBE_SECRET}};$(KUBE_SECRET);g" sidecar.yaml | sed -e "s;{{SA_NAME}};$(SA_NAME);g" | sed -e "s;{{IMAGE_TAG}};$(IMAGE_TAG);g" | kubectl create -f-
16+
@sed -e "s;{{TS_KUBE_SECRET}};$(TS_KUBE_SECRET);g" sidecar.yaml | sed -e "s;{{SA_NAME}};$(SA_NAME);g" | kubectl create -f-
2717

2818
userspace-sidecar:
2919
@kubectl delete -f userspace-sidecar.yaml --ignore-not-found --grace-period=0
30-
@sed -e "s;{{KUBE_SECRET}};$(KUBE_SECRET);g" userspace-sidecar.yaml | sed -e "s;{{SA_NAME}};$(SA_NAME);g" | sed -e "s;{{IMAGE_TAG}};$(IMAGE_TAG);g" | kubectl create -f-
20+
@sed -e "s;{{TS_KUBE_SECRET}};$(TS_KUBE_SECRET);g" userspace-sidecar.yaml | sed -e "s;{{SA_NAME}};$(SA_NAME);g" | kubectl create -f-
3121

3222
proxy:
33-
@kubectl delete -f proxy.yaml --ignore-not-found --grace-period=0
34-
@sed -e "s;{{KUBE_SECRET}};$(KUBE_SECRET);g" proxy.yaml | sed -e "s;{{SA_NAME}};$(SA_NAME);g" | sed -e "s;{{IMAGE_TAG}};$(IMAGE_TAG);g" | sed -e "s;{{DEST_IP}};$(DEST_IP);g" | kubectl create -f-
23+
kubectl delete -f proxy.yaml --ignore-not-found --grace-period=0
24+
sed -e "s;{{TS_KUBE_SECRET}};$(TS_KUBE_SECRET);g" proxy.yaml | sed -e "s;{{SA_NAME}};$(SA_NAME);g" | sed -e "s;{{TS_DEST_IP}};$(TS_DEST_IP);g" | kubectl create -f-
3525

3626
subnet-router:
3727
@kubectl delete -f subnet.yaml --ignore-not-found --grace-period=0
38-
@sed -e "s;{{KUBE_SECRET}};$(KUBE_SECRET);g" subnet.yaml | sed -e "s;{{SA_NAME}};$(SA_NAME);g" | sed -e "s;{{IMAGE_TAG}};$(IMAGE_TAG);g" | sed -e "s;{{ROUTES}};$(ROUTES);g" | kubectl create -f-
28+
@sed -e "s;{{TS_KUBE_SECRET}};$(TS_KUBE_SECRET);g" subnet.yaml | sed -e "s;{{SA_NAME}};$(SA_NAME);g" | sed -e "s;{{TS_ROUTES}};$(TS_ROUTES);g" | kubectl create -f-

‎docs/k8s/README.md

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,12 @@ There are quite a few ways of running Tailscale inside a Kubernetes Cluster, som
1515
AUTH_KEY: tskey-...
1616
```
1717
18-
1. Build and push the container
19-
20-
```bash
21-
export IMAGE_TAG=tailscale-k8s:latest
22-
make push
23-
```
24-
2518
1. Tailscale (v1.16+) supports storing state inside a Kubernetes Secret.
2619
2720
Configure RBAC to allow the Tailscale pod to read/write the `tailscale` secret.
2821
```bash
2922
export SA_NAME=tailscale
30-
export KUBE_SECRET=tailscale-auth
23+
export TS_KUBE_SECRET=tailscale-auth
3124
make rbac
3225
```
3326

@@ -82,11 +75,11 @@ Running a Tailscale proxy allows you to provide inbound connectivity to a Kubern
8275
```bash
8376
kubectl create deployment nginx --image nginx
8477
kubectl expose deployment nginx --port 80
85-
export DEST_IP="$(kubectl get svc nginx -o=jsonpath='{.spec.clusterIP}')"
78+
export TS_DEST_IP="$(kubectl get svc nginx -o=jsonpath='{.spec.clusterIP}')"
8679
```
8780
**Using an existing service**
8881
```bash
89-
export DEST_IP="$(kubectl get svc <SVC_NAME> -o=jsonpath='{.spec.clusterIP}')"
82+
export TS_DEST_IP="$(kubectl get svc <SVC_NAME> -o=jsonpath='{.spec.clusterIP}')"
9083
```
9184

9285
1. Deploy the proxy pod
@@ -114,12 +107,12 @@ Running a Tailscale proxy allows you to provide inbound connectivity to a Kubern
114107
Running a Tailscale [subnet router](https://tailscale.com/kb/1019/subnets/) allows you to access
115108
the entire Kubernetes cluster network (assuming NetworkPolicies allow) over Tailscale.
116109

117-
1. Identify the Pod/Service CIDRs that cover your Kubernetes cluster. These will vary depending on [which CNI](https://kubernetes.io/docs/concepts/cluster-administration/networking/) you are using and on the Cloud Provider you are using. Add these to the `ROUTES` variable as comma-separated values.
110+
1. Identify the Pod/Service CIDRs that cover your Kubernetes cluster. These will vary depending on [which CNI](https://kubernetes.io/docs/concepts/cluster-administration/networking/) you are using and on the Cloud Provider you are using. Add these to the `TS_ROUTES` variable as comma-separated values.
118111

119112
```bash
120113
SERVICE_CIDR=10.20.0.0/16
121114
POD_CIDR=10.42.0.0/15
122-
export ROUTES=$SERVICE_CIDR,$POD_CIDR
115+
export TS_ROUTES=$SERVICE_CIDR,$POD_CIDR
123116
```
124117

125118
1. Deploy the subnet-router pod.

‎docs/k8s/proxy.yaml

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
1+
# Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
22
# Use of this source code is governed by a BSD-style
33
# license that can be found in the LICENSE file.
44
apiVersion: v1
@@ -26,21 +26,21 @@ spec:
2626
containers:
2727
- name: tailscale
2828
imagePullPolicy: Always
29-
image: "{{IMAGE_TAG}}"
29+
image: "ghcr.io/tailscale/tailscale:latest"
3030
env:
3131
# Store the state in a k8s secret
32-
- name: KUBE_SECRET
33-
value: "{{KUBE_SECRET}}"
34-
- name: USERSPACE
32+
- name: TS_KUBE_SECRET
33+
value: "{{TS_KUBE_SECRET}}"
34+
- name: TS_USERSPACE
3535
value: "false"
36-
- name: AUTH_KEY
36+
- name: TS_AUTH_KEY
3737
valueFrom:
3838
secretKeyRef:
3939
name: tailscale-auth
4040
key: AUTH_KEY
4141
optional: true
42-
- name: DEST_IP
43-
value: "{{DEST_IP}}"
42+
- name: TS_DEST_IP
43+
value: "{{TS_DEST_IP}}"
4444
securityContext:
4545
capabilities:
4646
add:

‎docs/k8s/role.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
1+
# Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
22
# Use of this source code is governed by a BSD-style
33
# license that can be found in the LICENSE file.
44
apiVersion: rbac.authorization.k8s.io/v1
@@ -11,6 +11,6 @@ rules:
1111
# Create can not be restricted to a resource name.
1212
verbs: ["create"]
1313
- apiGroups: [""] # "" indicates the core API group
14-
resourceNames: ["{{KUBE_SECRET}}"]
14+
resourceNames: ["{{TS_KUBE_SECRET}}"]
1515
resources: ["secrets"]
1616
verbs: ["get", "update"]

‎docs/k8s/run.sh

Lines changed: 29 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,34 @@
1-
# Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
1+
# Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
22
# Use of this source code is governed by a BSD-style
33
# license that can be found in the LICENSE file.
44

55
#! /bin/sh
66

77
export PATH=$PATH:/tailscale/bin
88

9-
AUTH_KEY="${AUTH_KEY:-}"
10-
ROUTES="${ROUTES:-}"
11-
DEST_IP="${DEST_IP:-}"
12-
EXTRA_ARGS="${EXTRA_ARGS:-}"
13-
USERSPACE="${USERSPACE:-true}"
14-
KUBE_SECRET="${KUBE_SECRET:-tailscale}"
9+
TS_AUTH_KEY="${TS_AUTH_KEY:-}"
10+
TS_ROUTES="${TS_ROUTES:-}"
11+
TS_DEST_IP="${TS_DEST_IP:-}"
12+
TS_EXTRA_ARGS="${TS_EXTRA_ARGS:-}"
13+
TS_USERSPACE="${TS_USERSPACE:-true}"
14+
TS_STATE_DIR="${TS_STATE_DIR:-}"
15+
TS_ACCEPT_DNS="${TS_ACCEPT_DNS:-false}"
16+
TS_KUBE_SECRET="${TS_KUBE_SECRET:-tailscale}"
1517

1618
set -e
1719

18-
TAILSCALED_ARGS="--state=kube:${KUBE_SECRET} --socket=/tmp/tailscaled.sock"
20+
TAILSCALED_ARGS="--socket=/tmp/tailscaled.sock"
1921

20-
if [[ "${USERSPACE}" == "true" ]]; then
21-
if [[ ! -z "${DEST_IP}" ]]; then
22+
if [[ ! -z "${KUBERNETES_SERVICE_HOST}" ]]; then
23+
TAILSCALED_ARGS="${TAILSCALED_ARGS} --state=kube:${TS_KUBE_SECRET}"
24+
elif [[ ! -z "${TS_STATE_DIR}" ]]; then
25+
TAILSCALED_ARGS="${TAILSCALED_ARGS} --statedir=${TS_STATE_DIR}"
26+
else
27+
TAILSCALED_ARGS="${TAILSCALED_ARGS} --state=mem:"
28+
fi
29+
30+
if [[ "${TS_USERSPACE}" == "true" ]]; then
31+
if [[ ! -z "${TS_DEST_IP}" ]]; then
2232
echo "IP forwarding is not supported in userspace mode"
2333
exit 1
2434
fi
@@ -37,23 +47,23 @@ echo "Starting tailscaled"
3747
tailscaled ${TAILSCALED_ARGS} &
3848
PID=$!
3949

40-
UP_ARGS="--accept-dns=false"
41-
if [[ ! -z "${ROUTES}" ]]; then
42-
UP_ARGS="--advertise-routes=${ROUTES} ${UP_ARGS}"
50+
UP_ARGS="--accept-dns=${TS_ACCEPT_DNS}"
51+
if [[ ! -z "${TS_ROUTES}" ]]; then
52+
UP_ARGS="--advertise-routes=${TS_ROUTES} ${UP_ARGS}"
4353
fi
44-
if [[ ! -z "${AUTH_KEY}" ]]; then
45-
UP_ARGS="--authkey=${AUTH_KEY} ${UP_ARGS}"
54+
if [[ ! -z "${TS_AUTH_KEY}" ]]; then
55+
UP_ARGS="--authkey=${TS_AUTH_KEY} ${UP_ARGS}"
4656
fi
47-
if [[ ! -z "${EXTRA_ARGS}" ]]; then
48-
UP_ARGS="${UP_ARGS} ${EXTRA_ARGS:-}"
57+
if [[ ! -z "${TS_EXTRA_ARGS}" ]]; then
58+
UP_ARGS="${UP_ARGS} ${TS_EXTRA_ARGS:-}"
4959
fi
5060

5161
echo "Running tailscale up"
5262
tailscale --socket=/tmp/tailscaled.sock up ${UP_ARGS}
5363

54-
if [[ ! -z "${DEST_IP}" ]]; then
64+
if [[ ! -z "${TS_DEST_IP}" ]]; then
5565
echo "Adding iptables rule for DNAT"
56-
iptables -t nat -I PREROUTING -d "$(tailscale --socket=/tmp/tailscaled.sock ip -4)" -j DNAT --to-destination "${DEST_IP}"
66+
iptables -t nat -I PREROUTING -d "$(tailscale --socket=/tmp/tailscaled.sock ip -4)" -j DNAT --to-destination "${TS_DEST_IP}"
5767
fi
5868

5969
wait ${PID}

‎docs/k8s/sa.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
1+
# Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
22
# Use of this source code is governed by a BSD-style
33
# license that can be found in the LICENSE file.
44
apiVersion: v1

‎docs/k8s/sidecar.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
1+
# Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
22
# Use of this source code is governed by a BSD-style
33
# license that can be found in the LICENSE file.
44
apiVersion: v1
@@ -12,14 +12,14 @@ spec:
1212
image: nginx
1313
- name: ts-sidecar
1414
imagePullPolicy: Always
15-
image: "{{IMAGE_TAG}}"
15+
image: "ghcr.io/tailscale/tailscale:latest"
1616
env:
1717
# Store the state in a k8s secret
18-
- name: KUBE_SECRET
19-
value: "{{KUBE_SECRET}}"
20-
- name: USERSPACE
18+
- name: TS_KUBE_SECRET
19+
value: "{{TS_KUBE_SECRET}}"
20+
- name: TS_USERSPACE
2121
value: "false"
22-
- name: AUTH_KEY
22+
- name: TS_AUTH_KEY
2323
valueFrom:
2424
secretKeyRef:
2525
name: tailscale-auth

‎docs/k8s/subnet.yaml

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
1+
# Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
22
# Use of this source code is governed by a BSD-style
33
# license that can be found in the LICENSE file.
44
apiVersion: v1
@@ -12,21 +12,21 @@ spec:
1212
containers:
1313
- name: tailscale
1414
imagePullPolicy: Always
15-
image: "{{IMAGE_TAG}}"
15+
image: "ghcr.io/tailscale/tailscale:latest"
1616
env:
1717
# Store the state in a k8s secret
18-
- name: KUBE_SECRET
19-
value: "{{KUBE_SECRET}}"
20-
- name: USERSPACE
18+
- name: TS_KUBE_SECRET
19+
value: "{{TS_KUBE_SECRET}}"
20+
- name: TS_USERSPACE
2121
value: "true"
22-
- name: AUTH_KEY
22+
- name: TS_AUTH_KEY
2323
valueFrom:
2424
secretKeyRef:
2525
name: tailscale-auth
2626
key: AUTH_KEY
2727
optional: true
28-
- name: ROUTES
29-
value: "{{ROUTES}}"
28+
- name: TS_ROUTES
29+
value: "{{TS_ROUTES}}"
3030
securityContext:
3131
runAsUser: 1000
3232
runAsGroup: 1000

‎docs/k8s/userspace-sidecar.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
1+
# Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
22
# Use of this source code is governed by a BSD-style
33
# license that can be found in the LICENSE file.
44
apiVersion: v1
@@ -12,17 +12,17 @@ spec:
1212
image: nginx
1313
- name: ts-sidecar
1414
imagePullPolicy: Always
15-
image: "{{IMAGE_TAG}}"
15+
image: "ghcr.io/tailscale/tailscale:latest"
1616
securityContext:
1717
runAsUser: 1000
1818
runAsGroup: 1000
1919
env:
2020
# Store the state in a k8s secret
21-
- name: KUBE_SECRET
22-
value: "{{KUBE_SECRET}}"
23-
- name: USERSPACE
21+
- name: TS_KUBE_SECRET
22+
value: "{{TS_KUBE_SECRET}}"
23+
- name: TS_USERSPACE
2424
value: "true"
25-
- name: AUTH_KEY
25+
- name: TS_AUTH_KEY
2626
valueFrom:
2727
secretKeyRef:
2828
name: tailscale-auth

0 commit comments

Comments
 (0)