Migrate Tailscale to official k8s setup

charts/tailscale-relay/templates/_helpers.tpl

@@ -64,10 +64,37 @@ Generate basic annotations
 {{- end }}
 {{- end }}
 
+
 {{- define "app.serviceAccountName" -}}
-{{- if .Values.rbac.enabled -}}
-    {{ default (include "app.fullname" .) .Values.rbac.serviceAccount.name }}
-{{- else -}}
-    {{ default "default" .Values.rbac.serviceAccount.name }}
+    {{ default (include "app.fullname" .) .Values.rbac.serviceAccountName }}
+{{- end -}}
+
+{{- define "app.containerName" -}}
+    {{- if or .Values.sidecar.enabled .Values.userspaceSidecar.enabled -}}
+        "ts-sidecar"
+    {{- else -}}
+        "tailscale"
+    {{- end -}}
 {{- end -}}
+
+{{- define "app.podName" -}}
+    {{- if or .Values.sidecar.enabled .Values.userspaceSidecar.enabled -}}
+        "nginx"
+    {{- else if .Values.subnet.enabled -}}
+        "subnet-router"
+    {{- else -}}
+        "proxy"
+    {{- end -}}
 {{- end -}}
+
+{{- define "app.mode" -}}
+    {{- if and .sidecar.enabled  (not .userspaceSidecar.enabled)  (not .proxy.enabled) (not .subnet.enabled)}}
+        sidecar
+    {{- else if and (not .sidecar.enabled) .userspaceSidecar.enabled  (not .proxy.enabled) (not .subnet.enabled)}}
+        userspaceSidecar
+    {{- else if and (not .sidecar.enabled)  (not .userspaceSidecar.enabled) .proxy.enabled (not .subnet.enabled)}}
+        proxy
+    {{- else if and (not .sidecar.enabled)  (not .userspaceSidecar.enabled)  (not .proxy.enabled) .subnet.enabled}}
+        subnet
+    {{- end }}
+{{- end -}}

charts/tailscale-relay/templates/pod.yaml

@@ -0,0 +1,78 @@
+# Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file.
+
+{{- if include "app.mode" .Values }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ template "app.podName" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels: {{- include "app.labels" . | nindent 4 }}
+    {{- if .Values.labels }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.labels "context" $) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.annotations }}
+  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  serviceAccountName: {{ template "app.serviceAccountName" . }}
+  {{- if .Values.proxy.enabled }}
+  initContainers:
+    # In order to run as a proxy we need to enable IP Forwarding inside
+    # the container. The `net.ipv4.ip_forward` sysctl is not whitelisted
+    # in Kubelet by default.
+  - name: sysctler
+    image: busybox
+    securityContext:
+      privileged: true
+    command: ["/bin/sh"]
+    args:
+      - -c
+      - sysctl -w net.ipv4.ip_forward=1
+    resources:
+      requests:
+        cpu: 1m
+        memory: 1Mi
+  {{- end }}
+  containers:
+  {{- if or .Values.sidecar.enabled .Values.userspaceSidecar.enabled }}
+  - name: nginx
+    image: nginx
+  {{- end }}
+  - name: {{ template "app.containerName" . }}
+    imagePullPolicy: Always
+    image: "ghcr.io/tailscale/tailscale:latest"
+    env:
+      # Store the state in a k8s secret
+    - name: TS_KUBE_SECRET
+      value: {{ .Values.rbac.kubeSecretName }}
+    - name: TS_USERSPACE
+      value: "false"
+    - name: TS_AUTH_KEY
+      valueFrom:
+        secretKeyRef:
+          name: tailscale-auth
+          key: AUTH_KEY
+          optional: true
+    {{- if .Values.proxy.enabled }}
+    - name: TS_DEST_IP
+      value: {{ .Values.proxy.destinationIP }}
+    {{- end }}
+    {{- if .Values.subnet.enabled }}
+    - name: TS_ROUTES
+      value: {{ .Values.subnet.routes }}
+    {{- end }}
+    securityContext:
+      {{- if or .Values.sidecar.enabled .Values.proxy.enabled }}
+      capabilities:
+        add:
+        - NET_ADMIN
+      {{- else if or .Values.userspaceSidecar.enabled .Values.subnet.enabled }}
+      runAsUser: 1000
+      runAsGroup: 1000
+      {{- end }}
+    {{- with .Values.resources }}
+    resources: {{ toYaml . | nindent 6 }}
+    {{- end }}
+{{- end }}

charts/tailscale-relay/templates/role.yaml

@@ -1,18 +1,16 @@
-{{- if .Values.rbac.create }}
----
+# Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ template "app.fullname" . }}
-  annotations:
-    {{- include "app.annotations" . | indent 4 }}
-  labels:
-    {{- include "app.labels" . | indent 4 }}
+  name: tailscale
 rules:
-  - apiGroups: [""]
-    # TODO: Troubleshoot as for some obscure reason it doesn't seem to work
-    # when being scoped down to a single resource
-    # resourceNames: [ {{ .Values.rbac.stateSecretName }} ]
-    resources: ["secrets"]
-    verbs: ["create", "get", "update"]
-{{- end }}
+- apiGroups: [""] # "" indicates the core API group
+  resources: ["secrets"]
+  # Create can not be restricted to a resource name.
+  verbs: ["create"]
+- apiGroups: [""] # "" indicates the core API group
+  resourceNames: [ {{ .Values.rbac.kubeSecretName }} ]
+  resources: ["secrets"]
+  verbs: ["get", "update"]

charts/tailscale-relay/templates/rolebinding.yaml

@@ -1,18 +1,14 @@
-{{- if .Values.rbac.create }}
----
+# Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ template "app.fullname" . }}-{{ template "app.serviceAccountName" . }}
-  annotations:
-    {{- include "app.annotations" . | indent 4 }}
-  labels:
-    {{- include "app.labels" . | indent 4 }}
+  name: tailscale
 subjects:
-  - kind: ServiceAccount
-    name: {{ template "app.serviceAccountName" . }}
+- kind: ServiceAccount
+  name: {{ template "app.serviceAccountName" . }}
 roleRef:
   kind: Role
-  name: {{ template "app.fullname" . }}
+  name: tailscale
   apiGroup: rbac.authorization.k8s.io
-{{- end }}

charts/tailscale-relay/templates/sa.yaml

@@ -0,0 +1,15 @@
+# Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "app.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels: {{- include "app.labels" . | nindent 4 }}
+    {{- if .Values.labels }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.labels "context" $) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.annotations }}
+  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.annotations "context" $) | nindent 4 }}
+  {{- end }}

charts/tailscale-relay/templates/secret.yaml

@@ -1,12 +1,16 @@
----
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ template "app.fullname" . }}-config
-  annotations:
-    {{- include "app.annotations" . | indent 4 }}
-  labels:
-    {{- include "app.labels" . | indent 4 }}
+  name: {{ .Values.rbac.kubeSecretName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels: {{- include "app.labels" . | nindent 4 }}
+    {{- if .Values.labels }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.labels "context" $) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.annotations }}
+  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.annotations "context" $) | nindent 4 }}
+  {{- end }}
 type: Opaque
-stringData:
-  TAILSCALE_AUTH_KEY: {{ .Values.config.authKey }}
+data:
+  AUTH_KEY: {{ .Values.config.authKey | b64enc }}
+