Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale Kubernetes Operator

tailscale.com

Post reply on HN
Print view View original

31–40 of 56 posts

Re: Tailscale Kubernetes Operator

#31

Post by zalanak »

anonfunction wrote: post #29
sneak wrote: post #12

The amount of trust placed in DockerHub to serve the correct images to everyone for uncritical download and execution is insane to me. The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash. If I were TAO I'd apply for a job at Docker or their hosting provider.

What's TAO?

Might be referring to “Tailored Access Operations” which was an NSA office

Re: Tailscale Kubernetes Operator

#32

Post by samcat116 »

sneak wrote: post #12

The amount of trust placed in DockerHub to serve the correct images to everyone for uncritical download and execution is insane to me. The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash. If I were TAO I'd apply for a job at Docker or their hosting provider.

You could say this about any service serving software artifacts?

Re: Tailscale Kubernetes Operator

#33

Post by shawabawa3 »

vorpalhex wrote: post #26
shawabawa3 wrote: post #16

One thing that i think is really missing is redundancy on the proxies Currently there's no way to have two proxies that listen on the same tailscale hostname/ip Ideally in Kubernetes every pod is redundant to allow downscaling of nodes efficiently, so this means we have to eat a minute or so of downtime randomly every now and then on our tailscale endpoints

Can't you expose the services to two load balancers? Not ideal for anything customer facing but fine enough for staff.

they would have to have two separate hostnames/ips so you wouldn't have a single redundant endpoint

Re: Tailscale Kubernetes Operator

#35

Post by nineplay »

sneak wrote: post #12

The amount of trust placed in DockerHub to serve the correct images to everyone for uncritical download and execution is insane to me. The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash. If I were TAO I'd apply for a job at Docker or their hosting provider.

What's the alternative? I don't know of any reason to think that tarballs or installers are any better. I suppose I could clone the code and look for security flaws myself but I'm no expert and on something like nginx it's certain to be a waste of my time.

Re: Tailscale Kubernetes Operator

#38

Post by gameoverhumans »

shawabawa3 wrote: post #16

One thing that i think is really missing is redundancy on the proxies Currently there's no way to have two proxies that listen on the same tailscale hostname/ip Ideally in Kubernetes every pod is redundant to allow downscaling of nodes efficiently, so this means we have to eat a minute or so of downtime randomly every now and then on our tailscale endpoints

I agree, it's a feature that I find sorely lacking in my tailnet.

These are the relevant Github issues to follow, hopefully they address these someday:

https://github.com/tailscale/tailscale/issues/465 https://github.com/tailscale/tailscale/issues/4324

Re: Tailscale Kubernetes Operator

#40

Post by sneak »

samcat116 wrote: post #32
sneak wrote: post #12

The amount of trust placed in DockerHub to serve the correct images to everyone for uncritical download and execution is insane to me. The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash. If I were TAO I'd apply for a job at Docker or their hosting provider.

You could say this about any service serving software artifacts?

Unsigned ones, yes.
Post reply on HN