Erich Blume
d03ed337a9
Weekly non-local-container task: localize the Tailscale operator stack on **both clusters**. ## What - **`containers/tailscale-operator/`** (new) — builds `cmd/k8s-operator` v1.94.2 from the forge mirror, mirroring upstream's mkctr recipe (`/usr/local/bin/operator`, `ts_kube,ts_package_container` go tags, version stamps). `container.py` (dagger) for indri/arm64; `default.nix` for ringtail/amd64. - **`containers/tailscale/container.py`** (new) — dagger/arm64 build of the proxy image (containerboot), mirroring the upstream Dockerfile (iptables-legacy symlinks, `/tailscale/run.sh` compat). Ringtail already consumes the existing nix build; this completes parity for indri. - **Version pinned at v1.94.2** (same as currently deployed) — this PR is a pure supply-chain swap, no version change. v1.96.x is avoided deliberately (MagicDNS-in-containers regression). - Docs-first: tailscale-operator card gains **Local Images** and **Rollout Safety** sections. ## Rollout plan (after image builds) 1. Manifest commit: per-overlay `images:` override for the operator + ProxyClass strategic-merge patch on indri (kustomize `images:` can't touch CR fields). 2. `argocd app set tailscale-operator --revision <branch> && argocd app sync` — indri first, verify, then ringtail. 3. **Shadow-device safety**: device identity lives in the tailscale state Secrets; an image swap re-uses existing node keys, so no `-1` clones. State Secrets are not touched. Post-sync verification: pod health, device names unchanged, `mise run services-check`. ## Follow-ups (not this PR) - `dnsconfig` nameserver image (`tailscale/k8s-nameserver:stable`) still upstream. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #374
104 lines
2.9 KiB
Python
104 lines
2.9 KiB
Python
"""Tailscale proxy image (containerboot) — native Dagger build.
|
|
|
|
Builds cmd/tailscale, cmd/tailscaled, and cmd/containerboot from the forge
|
|
mirror, mirroring the upstream Dockerfile: Alpine runtime with iptables
|
|
(legacy symlinked over the default, per upstream issue #17854), iproute2,
|
|
and the /tailscale/run.sh compat symlink.
|
|
|
|
Consumed by the tailscale-operator ProxyClass on indri's minikube (arm64);
|
|
ringtail's ProxyClass uses the -nix tag from default.nix instead.
|
|
"""
|
|
|
|
import dagger
|
|
|
|
from blumeops.containers import (
|
|
alpine_runtime,
|
|
clone_from_forge,
|
|
go_build,
|
|
oci_labels,
|
|
)
|
|
|
|
VERSION = "v1.94.2"
|
|
|
|
|
|
async def build(src: dagger.Directory) -> dagger.Container:
|
|
source = clone_from_forge("tailscale", VERSION)
|
|
semver = VERSION.removeprefix("v")
|
|
|
|
ldflags = (
|
|
"-w -s"
|
|
f" -X tailscale.com/version.longStamp={semver}"
|
|
f" -X tailscale.com/version.shortStamp={semver}"
|
|
)
|
|
builder = go_build(
|
|
source,
|
|
"/out/tailscale",
|
|
cmd_path="./cmd/tailscale",
|
|
ldflags=ldflags,
|
|
)
|
|
builder = builder.with_exec(
|
|
[
|
|
"go",
|
|
"build",
|
|
f"-ldflags={ldflags}",
|
|
"-o",
|
|
"/out/tailscaled",
|
|
"./cmd/tailscaled",
|
|
]
|
|
).with_exec(
|
|
[
|
|
"go",
|
|
"build",
|
|
f"-ldflags={ldflags}",
|
|
"-o",
|
|
"/out/containerboot",
|
|
"./cmd/containerboot",
|
|
]
|
|
)
|
|
|
|
runtime = alpine_runtime(
|
|
extra_apk=["ca-certificates", "iptables", "iproute2", "ip6tables"],
|
|
create_user=False,
|
|
)
|
|
runtime = oci_labels(
|
|
runtime,
|
|
title="Tailscale",
|
|
description="Tailscale containerboot proxy image for the k8s operator",
|
|
version=VERSION,
|
|
)
|
|
return (
|
|
runtime
|
|
# Match upstream Dockerfile: nftables-backed iptables misbehaves in
|
|
# some environments, force the legacy backend (tailscale/tailscale#17854).
|
|
.with_exec(
|
|
[
|
|
"sh",
|
|
"-c",
|
|
"rm /usr/sbin/iptables && ln -s /usr/sbin/iptables-legacy /usr/sbin/iptables"
|
|
" && rm /usr/sbin/ip6tables && ln -s /usr/sbin/ip6tables-legacy /usr/sbin/ip6tables",
|
|
]
|
|
)
|
|
.with_file(
|
|
"/usr/local/bin/tailscale",
|
|
builder.file("/out/tailscale"),
|
|
permissions=0o555,
|
|
)
|
|
.with_file(
|
|
"/usr/local/bin/tailscaled",
|
|
builder.file("/out/tailscaled"),
|
|
permissions=0o555,
|
|
)
|
|
.with_file(
|
|
"/usr/local/bin/containerboot",
|
|
builder.file("/out/containerboot"),
|
|
permissions=0o555,
|
|
)
|
|
.with_exec(
|
|
[
|
|
"sh",
|
|
"-c",
|
|
"mkdir /tailscale && ln -s /usr/local/bin/containerboot /tailscale/run.sh",
|
|
]
|
|
)
|
|
.with_entrypoint(["/usr/local/bin/containerboot"])
|
|
)
|