fix: move deployment to correct path and enable OAuth auth mode

deployments/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: apps
-  labels:
-    name: apps

deployments/tailscale-operator/namespace.yaml

@@ -0,0 +1,49 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tailscale
+  labels:
+    app.kubernetes.io/name: tailscale-operator
+    app.kubernetes.io/part-of: infrastructure
+    management: gitops
+    managed-by: orion
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tailscale-operator
+  namespace: tailscale
+  labels:
+    app.kubernetes.io/name: tailscale-operator
+    app.kubernetes.io/part-of: infrastructure
+    management: gitops
+    managed-by: orion
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tailscale-operator
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tailscale-operator
+    spec:
+      serviceAccountName: tailscale-operator
+      containers:
+        - name: operator
+          image: ghcr.io/tailscale/k8s-operator:1.78.1
+          env:
+            - name: TS_AUTH_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: tailscale-auth
+                  key: TS_AUTH_KEY
+            - name: TS_USERSPACE
+              value: "true"
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi

deployments/tailscale/deployment.yaml

@@ -0,0 +1,51 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tailscale-operator
+  namespace: tailscale
+  labels:
+    app.kubernetes.io/name: tailscale-operator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tailscale-operator
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tailscale-operator
+    spec:
+      serviceAccountName: tailscale-operator
+      containers:
+        - name: operator
+          image: ghcr.io/tailscale/kubernetes-operator:latest
+          ports:
+            - containerPort: 8080
+              name: http
+          env:
+            - name: TS_USERSPACE
+              value: "true"
+            - name: TS_K8S_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: TS_TOKEN_SECRET_NAME
+              value: tailscale-operator-secret
+          envFrom:
+            - secretRef:
+                name: tailscale-operator-secret
+          volumeMounts:
+            - name: oauth-secret
+              mountPath: /etc/tailscale/oauth
+              readOnly: true
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+      volumes:
+        - name: oauth-secret
+          secret:
+            secretName: tailscale-operator-secret

deployments/tailscale/external-secret.yaml

@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1
+apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: tailscale-auth

deployments/tailscale/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: tailscale

deployments/tailscale/operator/deployment.yaml

@@ -19,7 +19,6 @@ spec:
       containers:
       - name: operator
         image: ghcr.io/tailscale/k8s-operator:v1.78.3
-        imagePullPolicy: IfNotPresent
         env:
         - name: POD_NAME
           valueFrom:
@@ -29,15 +28,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        - name: CLIENT_ID_FILE
-          value: /etc/tailscale/oauth/client-id
-        - name: CLIENT_SECRET_FILE
-          value: /etc/tailscale/oauth/client-secret
-        volumeMounts:
-        - name: oauth-secret
-          mountPath: /etc/tailscale/oauth
-          readOnly: true
-      volumes:
-      - name: oauth-secret
-        secret:
-          secretName: tailscale-operator-secret
+        - name: TS_AUTH_KEY
+          valueFrom:
+            secretKeyRef:
+              name: tailscale-auth
+              key: TS_AUTH_KEY

deployments/tailscale/operator/external-secret.yaml

@@ -1,22 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: tailscale-operator-secret
-  namespace: tailscale
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: orion-vault
-    kind: ClusterSecretStore
-  target:
-    name: tailscale-operator-secret
-    creationPolicy: Owner
-  data:
-    - secretKey: client-id
-      remoteRef:
-        key: tailscale/operator
-        property: CLIENT_ID_FILE
-    - secretKey: client-secret
-      remoteRef:
-        key: tailscale/operator
-        property: CLIENT_SECRET_FILE