feat: migrate tailscale-operator to OAuth auth mode

deployments/tailscale-operator/deployment.yaml

@@ -15,29 +15,41 @@ spec:
       labels:
         app: tailscale-operator
     spec:
-      serviceAccountName: tailscale-operator
       containers:
-      - name: operator
-        image: ghcr.io/tailscale/k8s-operator:v1.78.3
-        imagePullPolicy: IfNotPresent
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: TS_CLIENT_ID_FILE
-          value: /etc/tailscale/oauth/client-id
-        - name: TS_CLIENT_SECRET_FILE
-          value: /etc/tailscale/oauth/client-secret
-        volumeMounts:
-        - name: oauth-secret
-          mountPath: /etc/tailscale/oauth
-          readOnly: true
+        - name: operator
+          image: ghcr.io/tailscale/operator:latest
+          ports:
+            - containerPort: 8080
+              name: http-metrics
+              protocol: TCP
+          env:
+            - name: TS_KUBE_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          envFrom:
+            - secretRef:
+                name: tailscale-operator-secret
+          volumeMounts:
+            - name: oauth-config
+              mountPath: /etc/tailscale/oauth
+              readOnly: true
       volumes:
-      - name: oauth-secret
-        secret:
-          secretName: tailscale-operator-secret
+        - name: oauth-config
+          secret:
+            secretName: tailscale-operator-secret
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tailscale-operator
+  namespace: tailscale
+  labels:
+    app: tailscale-operator
+spec:
+  ports:
+    - port: 8080
+      name: http-metrics
+      targetPort: http-metrics
+  selector:
+    app: tailscale-operator

deployments/tailscale/operator/deployment.yaml

@@ -17,28 +17,34 @@ spec:
     spec:
       serviceAccountName: tailscale-operator
       containers:
-      - name: operator
-        image: ghcr.io/tailscale/k8s-operator:v1.78.3
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: metadata.namespace
-        - name: TS_CLIENT_ID_FILE
-          value: /etc/tailscale/oauth/client-id
-        - name: TS_CLIENT_SECRET_FILE
-          value: /etc/tailscale/oauth/client-secret
-        volumeMounts:
-        - name: oauth-secret
-          mountPath: /etc/tailscale/oauth
-          readOnly: true
+        - name: operator
+          image: ghcr.io/tailscale/k8s-operator:v1.78.3
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: TS_CLIENT_ID_FILE
+              value: /etc/tailscale/oauth/client-id
+            - name: TS_CLIENT_SECRET_FILE
+              value: /etc/tailscale/oauth/client-secret
+          volumeMounts:
+            - name: oauth-secret
+              mountPath: /etc/tailscale/oauth
+              readOnly: true
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
       volumes:
-      - name: oauth-secret
-        secret:
-          secretName: tailscale-operator-secret
+        - name: oauth-secret
+          secret:
+            secretName: tailscale-operator-secret