feat: migrate tailscale-operator to OAuth auth mode

deployments/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: apps
-  labels:
-    name: apps

deployments/tailscale-operator/deployment.yaml

@@ -0,0 +1,43 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tailscale-operator
+  namespace: tailscale
+  labels:
+    app: tailscale-operator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tailscale-operator
+  template:
+    metadata:
+      labels:
+        app: tailscale-operator
+    spec:
+      serviceAccountName: tailscale-operator
+      containers:
+      - name: operator
+        image: ghcr.io/tailscale/k8s-operator:v1.78.3
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: TS_CLIENT_ID_FILE
+          value: /etc/tailscale/oauth/client-id
+        - name: TS_CLIENT_SECRET_FILE
+          value: /etc/tailscale/oauth/client-secret
+        volumeMounts:
+        - name: oauth-secret
+          mountPath: /etc/tailscale/oauth
+          readOnly: true
+      volumes:
+      - name: oauth-secret
+        secret:
+          secretName: tailscale-operator-secret

deployments/tailscale-operator/namespace.yaml

@@ -0,0 +1,49 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tailscale
+  labels:
+    app.kubernetes.io/name: tailscale-operator
+    app.kubernetes.io/part-of: infrastructure
+    management: gitops
+    managed-by: orion
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tailscale-operator
+  namespace: tailscale
+  labels:
+    app.kubernetes.io/name: tailscale-operator
+    app.kubernetes.io/part-of: infrastructure
+    management: gitops
+    managed-by: orion
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tailscale-operator
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tailscale-operator
+    spec:
+      serviceAccountName: tailscale-operator
+      containers:
+        - name: operator
+          image: ghcr.io/tailscale/k8s-operator:1.78.1
+          env:
+            - name: TS_AUTH_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: tailscale-auth
+                  key: TS_AUTH_KEY
+            - name: TS_USERSPACE
+              value: "true"
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi

deployments/tailscale/external-secret.yaml

@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1
+apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: tailscale-auth

deployments/tailscale/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: tailscale

deployments/tailscale/operator/deployment.yaml

@@ -19,19 +19,20 @@ spec:
       containers:
       - name: operator
         image: ghcr.io/tailscale/k8s-operator:v1.78.3
-        imagePullPolicy: IfNotPresent
         env:
         - name: POD_NAME
           valueFrom:
             fieldRef:
+              apiVersion: v1
               fieldPath: metadata.name
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
+              apiVersion: v1
               fieldPath: metadata.namespace
-        - name: CLIENT_ID_FILE
+        - name: TS_CLIENT_ID_FILE
           value: /etc/tailscale/oauth/client-id
-        - name: CLIENT_SECRET_FILE
+        - name: TS_CLIENT_SECRET_FILE
           value: /etc/tailscale/oauth/client-secret
         volumeMounts:
         - name: oauth-secret

deployments/tailscale/operator/external-secret.yaml

@@ -1,22 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: tailscale-operator-secret
-  namespace: tailscale
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: orion-vault
-    kind: ClusterSecretStore
-  target:
-    name: tailscale-operator-secret
-    creationPolicy: Owner
-  data:
-    - secretKey: client-id
-      remoteRef:
-        key: tailscale/operator
-        property: CLIENT_ID_FILE
-    - secretKey: client-secret
-      remoteRef:
-        key: tailscale/operator
-        property: CLIENT_SECRET_FILE

deployments/tailscale/tailscale-operator/deployment.yaml

@@ -0,0 +1,37 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tailscale-operator
+  namespace: tailscale
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tailscale-operator
+  template:
+    metadata:
+      labels:
+        app: tailscale-operator
+    spec:
+      containers:
+      - name: operator
+        image: ghcr.io/tailscale/k8s-operator:latest
+        env:
+        - name: TS_K8S_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: TS_K8S_SECRET
+          value: tailscale-operator-secret
+        - name: TS_CLIENT_ID_FILE
+          value: /etc/tailscale/oauth/client-id
+        - name: TS_CLIENT_SECRET_FILE
+          value: /etc/tailscale/oauth/client-secret
+        volumeMounts:
+        - name: oauth-secret
+          mountPath: /etc/tailscale/oauth
+          readOnly: true
+      volumes:
+      - name: oauth-secret
+        secret:
+          secretName: tailscale-operator-secret

deployments/whoami/deployment.yaml

@@ -1,29 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: whoami
-  namespace: apps
-  labels:
-    app: whoami
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: whoami
-  template:
-    metadata:
-      labels:
-        app: whoami
-    spec:
-      containers:
-        - name: whoami
-          image: traefik/whoami:latest
-          ports:
-            - containerPort: 80
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi

deployments/whoami/ingress.yaml

@@ -1,26 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: whoami
-  namespace: apps
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-spec:
-  ingressClassName: traefik
-  tls:
-  - hosts:
-    - whoami.khalisio.com
-    secretName: whoami-tls
-  rules:
-  - host: whoami.khalisio.com
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: whoami
-            port:
-              number: 80

deployments/whoami/service.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: whoami
-  namespace: apps
-spec:
-  selector:
-    app: whoami
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-  type: ClusterIP