mirror/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2026-03-25 01:32:12 -04:00
Code Issues Packages Projects Releases Wiki Activity

cmd/k8s-proxy: use L4 TCPForward instead of L7 HTTP proxy (#18179)

Browse Source 
considerable latency was seen when using k8s-proxy with ProxyGroup
in the kubernetes operator. Switching to L4 TCPForward solves this.

Fixes tailscale#18171

Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
Co-authored-by: chaosinthecrd <tom@tmlabs.co.uk>
This commit is contained in:
Raj Singh
2026-03-05 13:47:54 -05:00
committed by GitHub
parent 1b53c00f2b
commit 19e2c8c49f
3 changed files with 21 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/k8s-operator/depaware.txt
View File

@@ -161,7 +161,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
💣 github.com/modern-go/reflect2 from github.com/json-iterator/go
github.com/munnerz/goautoneg from k8s.io/kube-openapi/pkg/handler3+
github.com/opencontainers/go-digest from github.com/distribution/reference
github.com/pires/go-proxyproto from tailscale.com/ipn/ipnlocal
github.com/pires/go-proxyproto from tailscale.com/ipn/ipnlocal+
github.com/pkg/errors from github.com/evanphx/json-patch/v5+
github.com/pmezard/go-difflib/difflib from k8s.io/apimachinery/pkg/util/diff
D github.com/prometheus-community/pro-bing from tailscale.com/wgengine/netstack

22
cmd/k8s-proxy/k8s-proxy.go
View File

@@ -50,6 +50,12 @@
"tailscale.com/tsnet"
)
const (
// proxyProtocolV2 enables PROXY protocol v2 to preserve original client
// connection info after TLS termination.
proxyProtocolV2 = 2
)
func main() {
encoderCfg := zap.NewProductionEncoderConfig()
encoderCfg.EncodeTime = zapcore.RFC3339TimeEncoder
@@ -441,24 +447,16 @@ func setServeConfig(ctx context.Context, lc *local.Client, cm *certs.CertManager
if err != nil {
return fmt.Errorf("error getting local client status: %w", err)
}
serviceHostPort := ipn.HostPort(fmt.Sprintf("%s.%s:443", name.WithoutPrefix(), status.CurrentTailnet.MagicDNSSuffix))
serviceSNI := fmt.Sprintf("%s.%s", name.WithoutPrefix(), status.CurrentTailnet.MagicDNSSuffix)
serveConfig := ipn.ServeConfig{
// Configure for the Service hostname.
Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
name: {
TCP: map[uint16]*ipn.TCPPortHandler{
443: {
HTTPS: true,
},
},
Web: map[ipn.HostPort]*ipn.WebServerConfig{
serviceHostPort: {
Handlers: map[string]*ipn.HTTPHandler{
"/": {
Proxy: "http://localhost:80",
},
},
TCPForward: "localhost:80",
TerminateTLS: serviceSNI,
ProxyProtocol: proxyProtocolV2,
},
},
},

11
k8s-operator/api-proxy/proxy.go
View File

@@ -21,6 +21,7 @@
"strings"
"time"
"github.com/pires/go-proxyproto"
"go.uber.org/zap"
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/apiserver/pkg/endpoints/request"
@@ -150,10 +151,18 @@ func (ap *APIServerProxy) Run(ctx context.Context) error {
}
} else {
var err error
proxyLn, err = net.Listen("tcp", "localhost:80")
baseLn, err := net.Listen("tcp", "localhost:80")
if err != nil {
return fmt.Errorf("could not listen on :80: %w", err)
}
proxyLn = &proxyproto.Listener{
Listener: baseLn,
ReadHeaderTimeout: 10 * time.Second,
ConnPolicy: proxyproto.ConnPolicyFunc(func(opts proxyproto.ConnPolicyOptions) (proxyproto.Policy,
error) {
return proxyproto.REQUIRE, nil
}),
}
serve = ap.hs.Serve
}