test

.gitea/workflows/validate.yaml

@@ -1,58 +0,0 @@
-name: Validate Manifests
-
-on:
-  pull_request:
-    branches: [main]
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install kubeconform
-        run: |
-          curl -sL https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz \
-            | tar xz -C /usr/local/bin
-          chmod +x /usr/local/bin/kubeconform
-
-      - name: Schema validation (kubeconform)
-        run: |
-          find . -name '*.yaml' -o -name '*.yml' \
-            | grep -v '\.gitea/' \
-            | sort \
-            | xargs kubeconform \
-                -strict \
-                -ignore-missing-schemas \
-                -kubernetes-version 1.30.0 \
-                -summary
-
-      - name: Install kubectl
-        run: |
-          K8S_VER=$(curl -sL https://dl.k8s.io/release/stable.txt)
-          curl -sLO "https://dl.k8s.io/release/${K8S_VER}/bin/linux/amd64/kubectl"
-          chmod +x kubectl && mv kubectl /usr/local/bin/kubectl
-
-      - name: Server-side dry-run (CRD existence check)
-        env:
-          KUBECONFIG_DATA: ${{ secrets.KUBECONFIG }}
-        run: |
-          echo "$KUBECONFIG_DATA" | base64 -d > /tmp/kube.yaml
-          # Apply all YAML files in sorted order — server-side dry-run rejects
-          # any apiVersion/Kind whose CRD is not installed in the cluster.
-          find . -name '*.yaml' -o -name '*.yml' \
-            | grep -v '\.gitea/' \
-            | sort \
-            | xargs -I{} kubectl apply \
-                --dry-run=server \
-                --kubeconfig /tmp/kube.yaml \
-                -f {} 2>&1 \
-            | tee /tmp/dryrun.log
-          rm -f /tmp/kube.yaml
-          # Fail if any "no kind is registered" or "no matches for kind" errors
-          if grep -qE "no kind is registered|no matches for kind|unknown field" /tmp/dryrun.log; then
-            echo "❌ Dry-run found unknown resources or fields — manifests reference CRDs not installed in the cluster"
-            exit 1
-          fi
-          echo "✅ All manifests passed server-side dry-run"

deployments/tailscale/external-secret.yaml

@@ -1,18 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: tailscale-auth
-  namespace: tailscale
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: orion-vault
-    kind: ClusterSecretStore
-  target:
-    name: tailscale-auth
-    creationPolicy: Owner
-  data:
-    - secretKey: TS_AUTH_KEY
-      remoteRef:
-        key: Talos Cluster/tailscale
-        property: TS_AUTH_KEY

deployments/tailscale/operator/clusterrole.yaml

@@ -1,17 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: tailscale-operator
-rules:
-  - apiGroups: [""]
-    resources: ["secrets", "configmaps", "services", "pods", "endpoints"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["apps"]
-    resources: ["deployments", "statefulsets", "daemonsets"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["tailscale.com"]
-    resources: ["*"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

deployments/tailscale/operator/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: tailscale-operator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tailscale-operator
-subjects:
-  - kind: ServiceAccount
-    name: tailscale-operator
-    namespace: tailscale

deployments/tailscale/operator/deployment.yaml

@@ -1,35 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tailscale-operator
-  template:
-    metadata:
-      labels:
-        app: tailscale-operator
-    spec:
-      serviceAccountName: tailscale-operator
-      containers:
-      - name: operator
-        image: ghcr.io/tailscale/k8s-operator:v1.78.3
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: TS_AUTH_KEY
-          valueFrom:
-            secretKeyRef:
-              name: tailscale-auth
-              key: TS_AUTH_KEY

deployments/tailscale/operator/serviceaccount.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator

infra/tailscale/deployment.yaml

@@ -1,13 +1,3 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: tailscale
-  labels:
-    app.kubernetes.io/name: tailscale-operator
-    app.kubernetes.io/part-of: infrastructure
-    management: gitops
-    managed-by: orion
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -15,9 +5,6 @@ metadata:
   namespace: tailscale
   labels:
     app.kubernetes.io/name: tailscale-operator
-    app.kubernetes.io/part-of: infrastructure
-    management: gitops
-    managed-by: orion
 spec:
   replicas: 1
   selector:
@@ -31,15 +18,13 @@ spec:
       serviceAccountName: tailscale-operator
       containers:
         - name: operator
-          image: ghcr.io/tailscale/k8s-operator:1.78.1
+          image: ghcr.io/tailscale/kubernetes-operator:v1.70.1
           env:
             - name: TS_AUTH_KEY
               valueFrom:
                 secretKeyRef:
                   name: tailscale-auth
                   key: TS_AUTH_KEY
-            - name: TS_USERSPACE
-              value: "true"
           resources:
             requests:
               cpu: 50m

infra/tailscale/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tailscale
+  labels:
+    app.kubernetes.io/name: tailscale

infra/tailscale/rbac.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tailscale-operator
+  namespace: tailscale
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: tailscale-operator
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments", "statefulsets", "daemonsets"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["services", "endpoints"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["policy.tailscale.com"]
+    resources: ["tailnets", "tailscales"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["policy.tailscale.com"]
+    resources: ["tailnets/status", "tailscales/status"]
+    verbs: ["get", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: tailscale-operator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: tailscale-operator
+subjects:
+  - kind: ServiceAccount
+    name: tailscale-operator
+    namespace: tailscale

infra/tailscale/tailnet-cr.yaml

@@ -0,0 +1,9 @@
+apiVersion: policy.tailscale.com/v1alpha1
+kind: Tailnet
+metadata:
+  name: default
+  namespace: tailscale
+spec:
+  tagAuths:
+    - tag: k8s-tailscale-operator
+      approved: true

tailscale/deployment.yaml

@@ -1,43 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tailscale-operator
-  template:
-    metadata:
-      labels:
-        app: tailscale-operator
-    spec:
-      serviceAccountName: tailscale-operator
-      containers:
-        - name: operator
-          image: ghcr.io/tailscale/k8s-operator:v1.78.3
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            - name: CLIENT_ID_FILE
-              value: /etc/tailscale/operator/client-id
-            - name: CLIENT_SECRET_FILE
-              value: /etc/tailscale/operator/client-secret
-          volumeMounts:
-            - name: operator-secret
-              mountPath: /etc/tailscale/operator
-              readOnly: true
-          resources: {}
-      volumes:
-        - name: operator-secret
-          secret:
-            secretName: tailscale-operator-secret

tailscale/tailscale-operator/deployment.yaml

@@ -1,42 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tailscale-operator
-  template:
-    metadata:
-      labels:
-        app: tailscale-operator
-    spec:
-      serviceAccountName: tailscale-operator
-      containers:
-      - name: operator
-        image: ghcr.io/tailscale/k8s-operator:v1.78.3
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: TS_CLIENT_ID_FILE
-          value: /etc/tailscale/oauth/client-id
-        - name: TS_CLIENT_SECRET_FILE
-          value: /etc/tailscale/oauth/client-secret
-        volumeMounts:
-        - name: oauth-secret
-          mountPath: /etc/tailscale/oauth
-          readOnly: true
-      volumes:
-      - name: oauth-secret
-        secret:
-          secretName: tailscale-operator-secret

test-file.yaml

@@ -0,0 +1 @@
+hello: world