feat: add ClusterSecretStore and ExternalSecret for Tailscale

deployments/tailscale/clusterrole.yaml

@@ -1,19 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: tailscale-operator
-  labels:
-    app: tailscale-operator
-rules:
-- apiGroups: [""]
-  resources: ["pods", "services", "secrets", "configmaps"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-- apiGroups: ["apps"]
-  resources: ["deployments", "statefulsets"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-- apiGroups: ["discovery.k8s.io"]
-  resources: ["endpointslices"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

deployments/tailscale/clusterrolebinding.yaml

@@ -1,14 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: tailscale-operator
-  labels:
-    app: tailscale-operator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tailscale-operator
-subjects:
-- kind: ServiceAccount
-  name: tailscale-operator
-  namespace: apps

deployments/tailscale/configmap.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: tailscale-operator
-  namespace: apps
-  labels:
-    app: tailscale-operator
-data:
-  TS_KUBE_OBJECT_STORE: "true"

deployments/tailscale/deployment.yaml

@@ -1,42 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tailscale-operator
-  namespace: apps
-  labels:
-    app: tailscale-operator
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tailscale-operator
-  template:
-    metadata:
-      labels:
-        app: tailscale-operator
-    spec:
-      serviceAccountName: tailscale-operator
-      containers:
-      - name: operator
-        image: ghcr.io/tailscale/k8s-operator:1.72.0
-        env:
-        - name: TS_AUTH_KEY
-          valueFrom:
-            secretKeyRef:
-              name: tailscale-auth
-              key: TS_AUTH_KEY
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        resources:
-          requests:
-            cpu: 50m
-            memory: 64Mi
-          limits:
-            cpu: 100m
-            memory: 128Mi

deployments/tailscale/external-secret.yaml

@@ -3,16 +3,21 @@ kind: ExternalSecret
 metadata:
   name: tailscale-auth
   namespace: tailscale
+  labels:
+    app: tailscale
+    managed-by: orion
 spec:
-  refreshInterval: 1h
+  refreshInterval: "1h"
   secretStoreRef:
     name: orion-vault
     kind: ClusterSecretStore
   target:
     name: tailscale-auth
     creationPolicy: Owner
+    template:
+      type: Opaque
   data:
   - secretKey: TS_AUTH_KEY
     remoteRef:
-      key: tailscale
-      property: TS_AUTH_KEY
+      key: secret/data/tailscale
+      property: TS_AUTH_KEY

deployments/tailscale/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: apps
-  labels:
-    name: apps

deployments/tailscale/operator/clusterrole.yaml

@@ -1,17 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: tailscale-operator
-rules:
-  - apiGroups: [""]
-    resources: ["secrets", "configmaps", "services", "pods", "endpoints"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["apps"]
-    resources: ["deployments", "statefulsets", "daemonsets"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["tailscale.com"]
-    resources: ["*"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

deployments/tailscale/operator/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: tailscale-operator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tailscale-operator
-subjects:
-  - kind: ServiceAccount
-    name: tailscale-operator
-    namespace: tailscale

deployments/tailscale/operator/deployment.yaml

@@ -1,35 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tailscale-operator
-  template:
-    metadata:
-      labels:
-        app: tailscale-operator
-    spec:
-      serviceAccountName: tailscale-operator
-      containers:
-      - name: operator
-        image: ghcr.io/tailscale/k8s-operator:v1.78.3
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: TS_AUTH_KEY
-          valueFrom:
-            secretKeyRef:
-              name: tailscale-auth
-              key: TS_AUTH_KEY

deployments/tailscale/operator/serviceaccount.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator

deployments/tailscale/serviceaccount.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tailscale-operator
-  namespace: apps
-  labels:
-    app: tailscale-operator

tailscale/deployment.yaml

@@ -4,21 +4,28 @@ metadata:
   name: tailscale-operator
   namespace: tailscale
   labels:
-    app: tailscale-operator
+    app.kubernetes.io/name: tailscale
+    app.kubernetes.io/component: operator
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: tailscale-operator
+      app.kubernetes.io/name: tailscale
+      app.kubernetes.io/component: operator
   template:
     metadata:
       labels:
-        app: tailscale-operator
+        app.kubernetes.io/name: tailscale
+        app.kubernetes.io/component: operator
     spec:
       serviceAccountName: tailscale-operator
+      securityContext:
+        runAsNonRoot: true
       containers:
       - name: operator
-        image: ghcr.io/tailscale/k8s-operator:v1.78.3
+        image: ghcr.io/tailscale/operator:v1.76.0
+        args:
+        - --hostname=$(POD_NAME)
         env:
         - name: POD_NAME
           valueFrom:
@@ -28,8 +35,32 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        - name: TS_AUTH_KEY
-          valueFrom:
-            secretKeyRef:
-              key: TS_AUTH_KEY
-              name: tailscale-auth
+        envFrom:
+        - secretRef:
+            name: tailscale-operator-secret
+        ports:
+        - containerPort: 8080
+          name: metrics
+          protocol: TCP
+        resources:
+          requests:
+            cpu: 10m
+            memory: 64Mi
+          limits:
+            cpu: 100m
+            memory: 128Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsUser: 1000
+          runAsGroup: 1000
+          capabilities:
+            drop:
+              - ALL
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: node-role.kubernetes.io/control-plane
+                operator: Exists