feat: migrate tailscale-operator to OAuth auth mode

Reviewed-on: #45

deployments/tailscale-operator/deployment.yaml

@@ -1,10 +1,10 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: tailscale-operator
-  namespace: tailscale
   labels:
     app: tailscale-operator
+  name: tailscale-operator
+  namespace: tailscale
 spec:
   replicas: 1
   selector:
@@ -15,41 +15,41 @@ spec:
       labels:
         app: tailscale-operator
     spec:
+      serviceAccountName: tailscale-operator
       containers:
         - name: operator
-          image: ghcr.io/tailscale/operator:latest
-          ports:
-            - containerPort: 8080
-              name: http-metrics
-              protocol: TCP
+          image: ghcr.io/tailscale/k8s-operator:v1.78.3
+          imagePullPolicy: IfNotPresent
           env:
-            - name: TS_KUBE_NAMESPACE
+            - name: POD_NAME
               valueFrom:
                 fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
                   fieldPath: metadata.namespace
-          envFrom:
-            - secretRef:
-                name: tailscale-operator-secret
+            - name: TS_CLIENT_ID_FILE
+              value: /etc/tailscale/oauth/client-id
+            - name: TS_CLIENT_SECRET_FILE
+              value: /etc/tailscale/oauth/client-secret
           volumeMounts:
-            - name: oauth-config
+            - name: oauth-secret
               mountPath: /etc/tailscale/oauth
               readOnly: true
+          resources: {}
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
       volumes:
-        - name: oauth-config
+        - name: oauth-secret
           secret:
             secretName: tailscale-operator-secret
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator
-spec:
-  ports:
-    - port: 8080
-      name: http-metrics
-      targetPort: http-metrics
-  selector:
-    app: tailscale-operator
+            defaultMode: 0600
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30
+      schedulerName: default
+      securityContext: {}
+      terminationGracePeriodSeconds: 30