feat: deploy Tailscale operator

deployments/tailscale-operator/deployment.yaml

@@ -0,0 +1,45 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tailscale-operator
+  namespace: tailscale
+  labels:
+    app: tailscale-operator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tailscale-operator
+  template:
+    metadata:
+      labels:
+        app: tailscale-operator
+    spec:
+      serviceAccountName: tailscale-operator
+      containers:
+        - name: operator
+          image: ghcr.io/tailscale/k8s-operator:v1.78.0
+          env:
+            - name: TS_AUTHKEY
+              valueFrom:
+                secretKeyRef:
+                  name: tailscale-auth
+                  key: TS_AUTH_KEY
+            - name: DEPLOYMENT_TYPE
+              value: "k8s"
+          ports:
+            - containerPort: 8080
+              name: http-metrics
+          readinessProbe:
+            httpGet:
+              path: /metrics
+              port: http-metrics
+            initialDelaySeconds: 10
+            periodSeconds: 15
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi

deployments/tailscale-operator/rbac.yaml

@@ -10,17 +10,14 @@ metadata:
   name: tailscale-operator
 rules:
   - apiGroups: [""]
-    resources: ["pods", "services", "endpoints", "namespaces", "events", "configmaps"]
-    verbs: ["get", "list", "watch", "create", "update", "patch"]
+    resources: ["secrets", "services", "endpoints", "namespaces", "nodes"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["apps"]
-    resources: ["deployments", "daemonsets"]
-    verbs: ["get", "list", "watch", "create", "update", "patch"]
+    resources: ["deployments", "statefulsets", "daemonsets"]
+    verbs: ["get", "list", "watch", "update", "patch"]
   - apiGroups: ["tailscale.com"]
     resources: ["*"]
-    verbs: ["get", "list", "watch", "create", "update", "patch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingressclasses"]
-    verbs: ["get", "list", "watch"]
+    verbs: ["*"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

talos-cluster/namespaces/tailscale.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: tailscale
-  labels:
-    name: tailscale

talos-cluster/tailscale/operator-deployment.yaml

@@ -1,34 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tailscale-operator
-  template:
-    metadata:
-      labels:
-        app: tailscale-operator
-    spec:
-      serviceAccountName: tailscale-operator
-      containers:
-        - name: operator
-          image: ghcr.io/tailscale/k8s-operator:v1.78.3
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            - name: TAILSCALE_API_CLIENT_ID
-              value: ""
-            - name: TAILSCALE_API_CLIENT_SECRET
-              value: ""