Skip to content

Commit 2a48766

Browse files
ChandonPierreChandonPierre
committed
Merge branch 'release-branch/1.84' into cpierre/coreweave-1.84
2 parents 290409f + 7648989 commit 2a48766

File tree

5 files changed

+86
-18
lines changed

5 files changed

+86
-18
lines changed

‎VERSION.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.84.1
1+
1.84.3

‎cmd/k8s-operator/ingress-for-pg.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -318,9 +318,9 @@ func (r *HAIngressReconciler) maybeProvision(ctx context.Context, hostname strin
318318
tags = strings.Split(tstr, ",")
319319
}
320320

321-
tsSvcPorts := []string{"443"} // always 443 for Ingress
321+
tsSvcPorts := []string{"tcp:443"} // always 443 for Ingress
322322
if isHTTPEndpointEnabled(ing) {
323-
tsSvcPorts = append(tsSvcPorts, "80")
323+
tsSvcPorts = append(tsSvcPorts, "tcp:80")
324324
}
325325

326326
tsSvc := &tailscale.VIPService{

‎cmd/k8s-operator/ingress-for-pg_test.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ func TestIngressPGReconciler(t *testing.T) {
6868
populateTLSSecret(context.Background(), fc, "test-pg", "my-svc.ts.net")
6969
expectReconciled(t, ingPGR, "default", "test-ingress")
7070
verifyServeConfig(t, fc, "svc:my-svc", false)
71-
verifyTailscaleService(t, ft, "svc:my-svc", []string{"443"})
71+
verifyTailscaleService(t, ft, "svc:my-svc", []string{"tcp:443"})
7272
verifyTailscaledConfig(t, fc, []string{"svc:my-svc"})
7373

7474
// Verify that Role and RoleBinding have been created for the first Ingress.
@@ -130,7 +130,7 @@ func TestIngressPGReconciler(t *testing.T) {
130130
populateTLSSecret(context.Background(), fc, "test-pg", "my-other-svc.ts.net")
131131
expectReconciled(t, ingPGR, "default", "my-other-ingress")
132132
verifyServeConfig(t, fc, "svc:my-other-svc", false)
133-
verifyTailscaleService(t, ft, "svc:my-other-svc", []string{"443"})
133+
verifyTailscaleService(t, ft, "svc:my-other-svc", []string{"tcp:443"})
134134

135135
// Verify that Role and RoleBinding have been created for the first Ingress.
136136
// Do not verify the cert Secret as that was already verified implicitly above.
@@ -139,7 +139,7 @@ func TestIngressPGReconciler(t *testing.T) {
139139

140140
// Verify first Ingress is still working
141141
verifyServeConfig(t, fc, "svc:my-svc", false)
142-
verifyTailscaleService(t, ft, "svc:my-svc", []string{"443"})
142+
verifyTailscaleService(t, ft, "svc:my-svc", []string{"tcp:443"})
143143

144144
verifyTailscaledConfig(t, fc, []string{"svc:my-svc", "svc:my-other-svc"})
145145

@@ -244,7 +244,7 @@ func TestIngressPGReconciler_UpdateIngressHostname(t *testing.T) {
244244
populateTLSSecret(context.Background(), fc, "test-pg", "my-svc.ts.net")
245245
expectReconciled(t, ingPGR, "default", "test-ingress")
246246
verifyServeConfig(t, fc, "svc:my-svc", false)
247-
verifyTailscaleService(t, ft, "svc:my-svc", []string{"443"})
247+
verifyTailscaleService(t, ft, "svc:my-svc", []string{"tcp:443"})
248248
verifyTailscaledConfig(t, fc, []string{"svc:my-svc"})
249249

250250
// Update the Ingress hostname and make sure the original Tailscale Service is deleted.
@@ -255,7 +255,7 @@ func TestIngressPGReconciler_UpdateIngressHostname(t *testing.T) {
255255
populateTLSSecret(context.Background(), fc, "test-pg", "updated-svc.ts.net")
256256
expectReconciled(t, ingPGR, "default", "test-ingress")
257257
verifyServeConfig(t, fc, "svc:updated-svc", false)
258-
verifyTailscaleService(t, ft, "svc:updated-svc", []string{"443"})
258+
verifyTailscaleService(t, ft, "svc:updated-svc", []string{"tcp:443"})
259259
verifyTailscaledConfig(t, fc, []string{"svc:updated-svc"})
260260

261261
_, err := ft.GetVIPService(context.Background(), tailcfg.ServiceName("svc:my-svc"))
@@ -475,7 +475,7 @@ func TestIngressPGReconciler_HTTPEndpoint(t *testing.T) {
475475
expectReconciled(t, ingPGR, "default", "test-ingress")
476476
populateTLSSecret(context.Background(), fc, "test-pg", "my-svc.ts.net")
477477
expectReconciled(t, ingPGR, "default", "test-ingress")
478-
verifyTailscaleService(t, ft, "svc:my-svc", []string{"80", "443"})
478+
verifyTailscaleService(t, ft, "svc:my-svc", []string{"tcp:80", "tcp:443"})
479479
verifyServeConfig(t, fc, "svc:my-svc", true)
480480

481481
// Verify Ingress status
@@ -528,7 +528,7 @@ func TestIngressPGReconciler_HTTPEndpoint(t *testing.T) {
528528

529529
// Verify reconciliation after removing HTTP
530530
expectReconciled(t, ingPGR, "default", "test-ingress")
531-
verifyTailscaleService(t, ft, "svc:my-svc", []string{"443"})
531+
verifyTailscaleService(t, ft, "svc:my-svc", []string{"tcp:443"})
532532
verifyServeConfig(t, fc, "svc:my-svc", false)
533533

534534
// Verify Ingress status

‎ipn/ipnlocal/local.go‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6142,17 +6142,17 @@ func (b *LocalBackend) setTCPPortsInterceptedFromNetmapAndPrefsLocked(prefs ipn.
61426142
}
61436143
}
61446144

6145-
// Update funnel info in hostinfo and kick off control update if needed.
6146-
b.updateIngressLocked()
6145+
// Update funnel and service hash info in hostinfo and kick off control update if needed.
6146+
b.updateIngressAndServiceHashLocked(prefs)
61476147
b.setTCPPortsIntercepted(handlePorts)
61486148
b.setVIPServicesTCPPortsInterceptedLocked(vipServicesPorts)
61496149
}
61506150

6151-
// updateIngressLocked updates the hostinfo.WireIngress and hostinfo.IngressEnabled fields and kicks off a Hostinfo
6152-
// update if the values have changed.
6151+
// updateIngressAndServiceHashLocked updates the hostinfo.ServicesHash, hostinfo.WireIngress and
6152+
// hostinfo.IngressEnabled fields and kicks off a Hostinfo update if the values have changed.
61536153
//
61546154
// b.mu must be held.
6155-
func (b *LocalBackend) updateIngressLocked() {
6155+
func (b *LocalBackend) updateIngressAndServiceHashLocked(prefs ipn.PrefsView) {
61566156
if b.hostinfo == nil {
61576157
return
61586158
}
@@ -6167,6 +6167,11 @@ func (b *LocalBackend) updateIngressLocked() {
61676167
b.hostinfo.WireIngress = wire
61686168
hostInfoChanged = true
61696169
}
6170+
latestHash := b.vipServiceHash(b.vipServicesFromPrefsLocked(prefs))
6171+
if b.hostinfo.ServicesHash != latestHash {
6172+
b.hostinfo.ServicesHash = latestHash
6173+
hostInfoChanged = true
6174+
}
61706175
// Kick off a Hostinfo update to control if ingress status has changed.
61716176
if hostInfoChanged {
61726177
b.goTracker.Go(b.doSetHostinfoFilterServices)

‎ipn/ipnlocal/local_test.go‎

Lines changed: 66 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5134,10 +5134,17 @@ func TestUpdatePrefsOnSysPolicyChange(t *testing.T) {
51345134
}
51355135
}
51365136

5137-
func TestUpdateIngressLocked(t *testing.T) {
5137+
func TestUpdateIngressAndServiceHashLocked(t *testing.T) {
5138+
prefs := ipn.NewPrefs().View()
5139+
previousSC := &ipn.ServeConfig{
5140+
Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
5141+
"svc:abc": {Tun: true},
5142+
},
5143+
}
51385144
tests := []struct {
51395145
name string
51405146
hi *tailcfg.Hostinfo
5147+
hasPreviousSC bool // whether to overwrite the ServeConfig hash in the Hostinfo using previousSC
51415148
sc *ipn.ServeConfig
51425149
wantIngress bool
51435150
wantWireIngress bool
@@ -5163,6 +5170,16 @@ func TestUpdateIngressLocked(t *testing.T) {
51635170
wantWireIngress: false, // implied by wantIngress
51645171
wantControlUpdate: true,
51655172
},
5173+
{
5174+
name: "empty_hostinfo_service_configured",
5175+
hi: &tailcfg.Hostinfo{},
5176+
sc: &ipn.ServeConfig{
5177+
Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
5178+
"svc:abc": {Tun: true},
5179+
},
5180+
},
5181+
wantControlUpdate: true,
5182+
},
51665183
{
51675184
name: "empty_hostinfo_funnel_disabled",
51685185
hi: &tailcfg.Hostinfo{},
@@ -5175,7 +5192,7 @@ func TestUpdateIngressLocked(t *testing.T) {
51755192
wantControlUpdate: true,
51765193
},
51775194
{
5178-
name: "empty_hostinfo_no_funnel",
5195+
name: "empty_hostinfo_no_funnel_no_service",
51795196
hi: &tailcfg.Hostinfo{},
51805197
sc: &ipn.ServeConfig{
51815198
TCP: map[uint16]*ipn.TCPPortHandler{
@@ -5196,6 +5213,16 @@ func TestUpdateIngressLocked(t *testing.T) {
51965213
wantIngress: true,
51975214
wantWireIngress: false, // implied by wantIngress
51985215
},
5216+
{
5217+
name: "service_hash_no_change",
5218+
hi: &tailcfg.Hostinfo{},
5219+
hasPreviousSC: true,
5220+
sc: &ipn.ServeConfig{
5221+
Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
5222+
"svc:abc": {Tun: true},
5223+
},
5224+
},
5225+
},
51995226
{
52005227
name: "funnel_disabled_no_change",
52015228
hi: &tailcfg.Hostinfo{
@@ -5208,6 +5235,13 @@ func TestUpdateIngressLocked(t *testing.T) {
52085235
},
52095236
wantWireIngress: true, // true if there is any AllowFunnel block
52105237
},
5238+
{
5239+
name: "service_got_removed",
5240+
hi: &tailcfg.Hostinfo{},
5241+
hasPreviousSC: true,
5242+
sc: &ipn.ServeConfig{},
5243+
wantControlUpdate: true,
5244+
},
52115245
{
52125246
name: "funnel_changes_to_disabled",
52135247
hi: &tailcfg.Hostinfo{
@@ -5235,12 +5269,35 @@ func TestUpdateIngressLocked(t *testing.T) {
52355269
wantWireIngress: false, // implied by wantIngress
52365270
wantControlUpdate: true,
52375271
},
5272+
{
5273+
name: "both_funnel_and_service_changes",
5274+
hi: &tailcfg.Hostinfo{
5275+
IngressEnabled: true,
5276+
},
5277+
sc: &ipn.ServeConfig{
5278+
AllowFunnel: map[ipn.HostPort]bool{
5279+
"tailnet.xyz:443": false,
5280+
},
5281+
Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
5282+
"svc:abc": {Tun: true},
5283+
},
5284+
},
5285+
wantWireIngress: true, // true if there is any AllowFunnel block
5286+
wantControlUpdate: true,
5287+
},
52385288
}
52395289

52405290
for _, tt := range tests {
52415291
t.Run(tt.name, func(t *testing.T) {
5292+
t.Parallel()
52425293
b := newTestLocalBackend(t)
52435294
b.hostinfo = tt.hi
5295+
if tt.hasPreviousSC {
5296+
b.mu.Lock()
5297+
b.serveConfig = previousSC.View()
5298+
b.hostinfo.ServicesHash = b.vipServiceHash(b.vipServicesFromPrefsLocked(prefs))
5299+
b.mu.Unlock()
5300+
}
52445301
b.serveConfig = tt.sc.View()
52455302
allDone := make(chan bool, 1)
52465303
defer b.goTracker.AddDoneCallback(func() {
@@ -5256,7 +5313,7 @@ func TestUpdateIngressLocked(t *testing.T) {
52565313
})()
52575314

52585315
was := b.goTracker.StartedGoroutines()
5259-
b.updateIngressLocked()
5316+
b.updateIngressAndServiceHashLocked(prefs)
52605317

52615318
if tt.hi != nil {
52625319
if tt.hi.IngressEnabled != tt.wantIngress {
@@ -5265,6 +5322,12 @@ func TestUpdateIngressLocked(t *testing.T) {
52655322
if tt.hi.WireIngress != tt.wantWireIngress {
52665323
t.Errorf("WireIngress = %v, want %v", tt.hi.WireIngress, tt.wantWireIngress)
52675324
}
5325+
b.mu.Lock()
5326+
svcHash := b.vipServiceHash(b.vipServicesFromPrefsLocked(prefs))
5327+
b.mu.Unlock()
5328+
if tt.hi.ServicesHash != svcHash {
5329+
t.Errorf("ServicesHash = %v, want %v", tt.hi.ServicesHash, svcHash)
5330+
}
52685331
}
52695332

52705333
startedGoroutine := b.goTracker.StartedGoroutines() != was

0 commit comments

Comments
 (0)