mirror of
https://github.com/tailscale/tailscale.git
synced 2026-09-15 15:29:33 -04:00
David Bond
80522b814c
The sysctler init container shells out to sysctl to turn on IP forwarding for non-userspace proxies. That binary ships in the procps-ng package, which Alpine has but Red Hat's UBI does not, so on UBI the init container exits 127 and every proxy Pod is stuck in PodInitializing and never registers a device. Updates: https://github.com/tailscale/corp/issues/45981 Updates: https://github.com/tailscale/corp/issues/44443 Signed-off-by: David Bond <davidsbond93@gmail.com>
45 lines
1.4 KiB
YAML
45 lines
1.4 KiB
YAML
# This file is not a complete manifest, it's a skeleton that the operator embeds
|
|
# at build time and then uses to construct Tailscale proxy pods.
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata: {}
|
|
spec:
|
|
replicas: 1
|
|
template:
|
|
metadata:
|
|
deletionGracePeriodSeconds: 10
|
|
spec:
|
|
serviceAccountName: proxies
|
|
initContainers:
|
|
- name: sysctler
|
|
securityContext:
|
|
privileged: true
|
|
command: ["/bin/sh", "-c"]
|
|
# Write to /proc/sys directly rather than shelling out to sysctl, which
|
|
# is not present in all base images (e.g. Red Hat's UBI).
|
|
args: ["echo 1 > /proc/sys/net/ipv4/ip_forward && if [ -e /proc/sys/net/ipv6/conf/all/forwarding ]; then echo 1 > /proc/sys/net/ipv6/conf/all/forwarding; fi"]
|
|
containers:
|
|
- name: tailscale
|
|
resources:
|
|
requests:
|
|
cpu: 1m
|
|
memory: 1Mi
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: TS_USERSPACE
|
|
value: "false"
|
|
- name: POD_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.podIP
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: POD_UID
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.uid
|
|
securityContext:
|
|
privileged: true
|