Skip to content

fix(tunnel): forward advertised TCP and UDP ports through tsnet #765

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Baylem wants to merge 6 commits into
base: master
Choose a base branch
from
Open

fix(tunnel): forward advertised TCP and UDP ports through tsnet #765

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9f2ce75
fix(tunnel): forward advertised Tailscale TCP and UDP traffic
Baylem Oct 21, 2026
7ce6915
merge: include shared web build prerequisite
Baylem Oct 21, 2026
fd20432
fix: normalize relay diagnostics and generated CRD inputs
Baylem Oct 21, 2026
2d151dd
fix(e2e): read metrics probes from completed pod logs
Baylem Oct 22, 2026
0139ddd
fix(ci): integrate upstream selection and current Tailscale SDK
Baylem Oct 23, 2026
f2b9be5
chore: synchronize CRDs with workspace generator
Baylem Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .devcontainer/devcontainer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
"username": "vscode"
},
"ghcr.io/devcontainers/features/go:1": {
"version": "1.26"
"version": "1.27.3"
},
"ghcr.io/devcontainers/features/node:1": {
"version": "24"
Expand Down
4 changes: 2 additions & 2 deletions .github/actions/go-cache/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ inputs:
go-version:
description: Go version to setup
required: false
default: '1.26'
default: '1.27'

runs:
using: composite
Expand All @@ -20,7 +20,7 @@ runs:
id: go
with:
go-version: ${{ inputs.go-version }}
# Resolve '1.26' to the newest 1.26.x patch instead of the runner's
# Resolve '1.27' to the newest 1.27.x patch (at least 1.27.3) instead of the runner's
# preinstalled one, so stdlib fixes (spec 013 G1, govulncheck) land
# without a manual pin bump.
check-latest: true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -439,7 +439,7 @@ jobs:
needs: [changes]
if: (needs.changes.outputs.images == 'true') || contains(fromJSON(needs.changes.outputs.ci-jobs || '[]'), 'build-images')
runs-on: ubuntu-latest
timeout-minutes: 15
timeout-minutes: 30
permissions:
contents: read
steps:
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backups.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: backups.gameplane.local
spec:
group: gameplane.local
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backupschedules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: backupschedules.gameplane.local
spec:
group: gameplane.local
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/charts/gameplane-crds/crds/gameplane.local_clusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: clusters.gameplane.local
spec:
group: gameplane.local
Expand Down
19 changes: 8 additions & 11 deletions charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gameservers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: gameservers.gameplane.local
spec:
group: gameplane.local
Expand Down Expand Up @@ -1546,15 +1546,12 @@ spec:
tags:
description: |-
Tags are Tailscale ACL tags requested for the device when it
registers, via `tailscale up --advertise-tags` (tailscaled's
declarative config has no field for tags, and changing the tags of a
registered node needs a fresh login). Each entry is "tag:<name>" or a bare
name, which gets the "tag:" prefix. The tailnet ACL must grant
tagOwners for these tags to the auth key's owner; if the request is
refused, the tunnel pod logs the error and the tunnel runs untagged.
If any entry is invalid, the whole list is logged and ignored and the
device registers untagged. See
tunnel/specs.md.
registers through embedded tsnet. Each entry is "tag:<name>" or a
bare name, which gets the "tag:" prefix. The tailnet policy must grant
tagOwners to the auth key's owner. Invalid or refused tags keep the
tunnel not ready; it never silently registers without requested tags.
Changing tags replaces the Pod and requires a reusable auth key.
See tunnel/specs.md for identity persistence and registration details.
items:
type: string
maxItems: 8
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gametemplates.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: gametemplates.gameplane.local
spec:
group: gameplane.local
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: modules.gameplane.local
spec:
group: gameplane.local
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modulesources.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: modulesources.gameplane.local
spec:
group: gameplane.local
Expand Down
23 changes: 8 additions & 15 deletions charts/gameplane/charts/gameplane-crds/crds/gameplane.local_networkcaptures.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: networkcaptures.gameplane.local
spec:
group: gameplane.local
Expand Down Expand Up @@ -209,22 +209,15 @@ spec:
format: int64
type: integer
phase:
allOf:
- enum:
- Pending
- Running
- Completed
- Failed
- Expired
- enum:
- Pending
- Running
- Completed
- Failed
- Expired
description: |-
Phase is the current lifecycle phase of the capture.
Valid values: Pending, Running, Completed, Failed, Expired.
enum:
- Pending
- Running
- Completed
- Failed
- Expired
type: string
startTime:
description: |-
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/charts/gameplane-crds/crds/gameplane.local_restores.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: restores.gameplane.local
spec:
group: gameplane.local
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/crd-manifests/gameplane.local_backups.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: backups.gameplane.local
spec:
group: gameplane.local
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/crd-manifests/gameplane.local_backupschedules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: backupschedules.gameplane.local
spec:
group: gameplane.local
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/crd-manifests/gameplane.local_clusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: clusters.gameplane.local
spec:
group: gameplane.local
Expand Down
19 changes: 8 additions & 11 deletions charts/gameplane/crd-manifests/gameplane.local_gameservers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: gameservers.gameplane.local
spec:
group: gameplane.local
Expand Down Expand Up @@ -1546,15 +1546,12 @@ spec:
tags:
description: |-
Tags are Tailscale ACL tags requested for the device when it
registers, via `tailscale up --advertise-tags` (tailscaled's
declarative config has no field for tags, and changing the tags of a
registered node needs a fresh login). Each entry is "tag:<name>" or a bare
name, which gets the "tag:" prefix. The tailnet ACL must grant
tagOwners for these tags to the auth key's owner; if the request is
refused, the tunnel pod logs the error and the tunnel runs untagged.
If any entry is invalid, the whole list is logged and ignored and the
device registers untagged. See
tunnel/specs.md.
registers through embedded tsnet. Each entry is "tag:<name>" or a
bare name, which gets the "tag:" prefix. The tailnet policy must grant
tagOwners to the auth key's owner. Invalid or refused tags keep the
tunnel not ready; it never silently registers without requested tags.
Changing tags replaces the Pod and requires a reusable auth key.
See tunnel/specs.md for identity persistence and registration details.
items:
type: string
maxItems: 8
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/crd-manifests/gameplane.local_gametemplates.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: gametemplates.gameplane.local
spec:
group: gameplane.local
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/crd-manifests/gameplane.local_modules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: modules.gameplane.local
spec:
group: gameplane.local
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/crd-manifests/gameplane.local_modulesources.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: modulesources.gameplane.local
spec:
group: gameplane.local
Expand Down
23 changes: 8 additions & 15 deletions charts/gameplane/crd-manifests/gameplane.local_networkcaptures.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: networkcaptures.gameplane.local
spec:
group: gameplane.local
Expand Down Expand Up @@ -209,22 +209,15 @@ spec:
format: int64
type: integer
phase:
allOf:
- enum:
- Pending
- Running
- Completed
- Failed
- Expired
- enum:
- Pending
- Running
- Completed
- Failed
- Expired
description: |-
Phase is the current lifecycle phase of the capture.
Valid values: Pending, Running, Completed, Failed, Expired.
enum:
- Pending
- Running
- Completed
- Failed
- Expired
type: string
startTime:
description: |-
Expand Down
4 changes: 2 additions & 2 deletions charts/gameplane/crd-manifests/gameplane.local_restores.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
controller-gen.kubebuilder.io/version: v0.20.1
gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
controller-gen.kubebuilder.io/version: v0.22.0
name: restores.gameplane.local
spec:
group: gameplane.local
Expand Down
Loading