PeerRelay

tailscale.com / v1alpha1

apiVersion: tailscale.com/v1alpha1 kind: PeerRelay metadata: name: example

apiVersion string

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

kind string

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata object required

spec object required

Spec describes the desired state of the PeerRelay. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

aws object

AWS contains configuration for pinning each replica to a specific AWS Elastic IP and subnet. Only meaningful when running on EKS with the AWS Load Balancer Controller. When set, the per-replica values override any aws-load-balancer-eip-allocations or aws-load-balancer-subnets values supplied via spec.service.annotations. Leave this unset unless the peer relays must be reachable on addresses you control. Pinning a subnet confines a replica's load balancer to that subnet's availability zone, and an AWS Network Load Balancer only forwards to targets in a zone that is enabled on it, so a replica whose pod is scheduled into any other zone stops receiving traffic. Setting this field therefore also requires pinning the pods to the matching zone with a ProxyClass, as described on ElasticIPs. Without this field the AWS Load Balancer Controller instead provisions each load balancer across every zone it discovers, and the operator turns on cross-zone load balancing so the replica is reachable wherever it happens to be scheduled, with no scheduling constraints needed.

elasticIPs []object required

ElasticIPs pins each replica to a specific AWS EIP allocation and subnet. Only meaningful when Network Load Balancers are provisioned by the AWS Load Balancer Controller. ElasticIPs supplies one allocation-subnet pair per replica: replica N uses ElasticIPs[N]. The list must be at least as long as spec.replicas so every replica has a distinct EIP; extra entries are permitted so that scale-up doesn't immediately trip validation. Pinning a subnet enables only that subnet's availability zone on the replica's load balancer, and a Network Load Balancer only forwards to targets in an enabled zone. Nothing constrains the scheduler to place the replica's pod in that zone, so a pod scheduled elsewhere, including after a reschedule, becomes unreachable on its Elastic IP while still appearing healthy. Every replica of a PeerRelay shares one pod template, so a ProxyClass referenced by spec.proxyClass can confine the pods to a zone but cannot place different replicas in different zones. To use this field safely, name subnets in a single availability zone and pin the pods to that same zone with a ProxyClass setting spec.statefulSet.pod.nodeSelector to topology.kubernetes.io/zone. Note that this trades the zone redundancy that running several replicas would otherwise buy. Spreading replicas across zones with their own Elastic IPs needs a per-replica scheduling constraint that neither PeerRelay nor ProxyClass can currently express. When set, the reconciler stamps service.beta.kubernetes.io/aws-load-balancer-eip-allocations and service.beta.kubernetes.io/aws-load-balancer-subnets on each per-replica Service, overriding any values in spec.service.annotations.

minItems: 1

allocationID string required

AllocationID is the AWS EIP allocation ID (e.g. eipalloc-0123abcd) whose public IP this replica is reachable on. Stamped as service.beta.kubernetes.io/aws-load-balancer-eip-allocations on the replica's Service.

pattern: ^eipalloc-[0-9a-f]+$

subnetID string required

SubnetID is the AWS subnet the replica's load balancer is provisioned in (e.g. subnet-0123abcd). It must be a public subnet, and no two replicas may name subnets in the same availability zone, since a load balancer accepts only one Elastic IP per zone. A standard VPC Elastic IP is regional rather than zonal, so it takes the zone of whichever subnet it is paired with here. Stamped as service.beta.kubernetes.io/aws-load-balancer-subnets on the replica's Service.

pattern: ^subnet-[0-9a-f]+$

hostnamePrefix string

HostnamePrefix specifies the hostname prefix for each replica. Each device will have the integer number from its StatefulSet pod appended to this prefix to form the full hostname. HostnamePrefix can contain lower case letters, numbers and dashes, it must not start with a dash and must be between 1 and 62 characters long.

pattern: ^[a-z0-9][a-z0-9-]{0,61}$

proxyClass string

ProxyClass is the name of the ProxyClass custom resource that contains configuration options that should be applied to the resources created for this PeerRelay. If unset, the operator will create resources with the default configuration.

replicas integer

Replicas specifies how many devices to create. Set this to enable high availability for peer relays. https://tailscale.com/kb/1115/high-availability. Defaults to 1.

format: int32

minimum: 0

service object

Service contains configuration values to modify the LoadBalancer service used to expose the peer relay.

annotations object

Annotations to apply to the LoadBalancer service. Any annotations that conflict with those used by known cloud providers to ensure IP addresses rather than DNS names are ignored.

tags []string

Tags that the Tailscale node will be tagged with. Defaults to [tag:k8s]. To autoapprove the device defined by a PeerRelay, you can configure Tailscale ACLs to give these tags the necessary permissions. See https://tailscale.com/kb/1337/acl-syntax#autoapprovers. If you specify custom tags here, you must also make the operator an owner of these tags. See https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator. Tags cannot be changed once a PeerRelay node has been created. Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.

tailnet string

Tailnet specifies the tailnet this PeerRelay should join. If blank, the default tailnet is used. When set, this name must match that of a valid Tailnet resource. This field is immutable and cannot be changed once set.

status object

Status describes the status of the PeerRelay. This is set and managed by the Tailscale operator.

conditions []object

lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

message string required

message is a human readable message indicating details about the transition. This may be an empty string.

maxLength: 32768

observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64

minimum: 0

reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$

minLength: 1

maxLength: 1024

status string required

status of the condition, one of True, False, Unknown.

enum: True, False, Unknown

type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

maxLength: 316

endpoints []object

Endpoints lists the public address:port pairs each peer relay replica is reachable on. Entries appear as the underlying cloud provisions each Service. A replica has one entry per address its LoadBalancer Service was given, which is usually one, but a load balancer spanning several availability zones has an address in each and every one of them is listed.

address string required

Address is the public IP or hostname the cloud has allocated for this replica's LoadBalancer Service. Peers reach this relay by connecting to Address:Port over UDP.

port integer required

Port is the UDP port the peer relay listens on.

format: int32

replica integer required

Replica is the zero-based index of the peer relay replica this endpoint targets.

format: int32

No matches. Try .spec.aws for an exact path