tailscale / tailscale

The easiest, most secure way to use WireGuard and 2FA.
https://tailscale.com
BSD 3-Clause "New" or "Revised" License
16.89k stars 1.28k forks source link

cmd/{k8s-nameserver,k8s-operator},k8s-operator: add a kube nameserver, make operator deploy it #11919

Closed irbekrm closed 2 weeks ago

irbekrm commented 3 weeks ago

This is https://github.com/tailscale/tailscale/pull/11017 that was already once merged, but I reverted it just before 1.64 release in https://github.com/tailscale/tailscale/pull/11669 as we did not have the bandwidth to review the second part (https://github.com/tailscale/tailscale/pull/11019) and I did not want to release half of a feature. Below is the original PR description, the contents haven't changed:

This PR is the first part of the work towards enabling support for MagicDNS name resolution from within Kubernetes cluster. Second part that updates the nameserver config with 'DNS records' is in https://github.com/tailscale/tailscale/pull/11019. This PR:

Operator advertizes the nameserver's Service IP address on the DNSConfig status. Users can read it from there to update clusterDNS. Example flow:

  1. Apply a DNSConfig:

    apiVersion: tailscale.com/v1alpha1
    kind: DNSConfig 
    metadata:
    name: ts-dns
    spec:
    nameserver:
    image:
      repo: gcr.io/csi-test-290908/nameserver // official images are not published yet- this is from a registry of mine
      tag: v0.0.64dns
  2. Wait for the DNSConfig's status to be updated:

    $ kubectl get dnsconfig ts-dns
    NAME     NAMESERVERIP
    ts-dns   10.44.11.171
  3. Update cluster DNS to add a stub nameserver for ts.net (the following example is for kube-dns, Corefile has different syntax):

apiVersion: v1
data:
  stubDomains: |
    {
      "ts.net": ["10.44.11.171"]
    }
kind: ConfigMap
metadata:
  labels:
    addonmanager.kubernetes.io/mode: EnsureExists
  name: kube-dns
  namespace: kube-system
irbekrm commented 2 weeks ago

Thanks for review @oxtoacart , I am going to merge this and rebase #11019 . I am going to think about and experiment with https://github.com/tailscale/tailscale/pull/11919#discussion_r1585124332 a bit more separately (will create an issue once these three initial pieces get merged)