sirius/gcloud-lab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
gcloud-lab/infrastructure/controllers/base/tailscale/release-operator.yaml

44 lines
928 B
YAML
Raw Permalink Normal View History

feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: tailscale-operator
namespace: tailscale
spec:
interval: 1h
fix: increase tailscale-operator HelmRelease timeout to 15m
2026-05-04 00:50:43 +00:00
timeout: 15m
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
chart:
spec:
chart: tailscale-operator
Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity - Bump chart version 1.86.x -> 1.96.x - Migrate operator: -> operatorConfig: (new chart structure) - Disable OAuth/OIDC to use existing authkey secret - Add securityContext for restricted:latest PodSecurity policy - Add podSecurityContext.runAsNonRoot - Drop ALL capabilities, disable privilege escalation - Add RuntimeDefault seccomp profile
2026-05-04 01:41:50 +00:00
version: "1.96.x"
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
sourceRef:
kind: HelmRepository
name: tailscale
namespace: tailscale
interval: 12h
targetNamespace: tailscale
install:
createNamespace: true
crds: Create
upgrade:
crds: CreateReplace
values:
Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity - Bump chart version 1.86.x -> 1.96.x - Migrate operator: -> operatorConfig: (new chart structure) - Disable OAuth/OIDC to use existing authkey secret - Add securityContext for restricted:latest PodSecurity policy - Add podSecurityContext.runAsNonRoot - Drop ALL capabilities, disable privilege escalation - Add RuntimeDefault seccomp profile
2026-05-04 01:41:50 +00:00
operatorConfig:
Remove invalid Tailscale operator tags The tag:k8s-operator and tag:tailnet tags don't exist in tailnet ACLs, causing 400 errors on key creation. Set tags to empty for now.
2026-05-04 03:59:05 +00:00
tags: []
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
operatorSecretRef:
Fix Tailscale operator secret name to 'operator'
2026-05-04 03:20:46 +00:00
name: operator
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
key: authkey
logFile: "/var/log/tailscale.log"
waitForLinkLocal: false
Fix Tailscale operator: add securityContext for PodSecurity restricted policy The merged PR was missing securityContext/podSecurityContext values required by the namespace's restricted:latest PodSecurity policy. Without these, pods fail to create with FailedCreate errors.
2026-05-04 02:26:09 +00:00
useOAuth: false
useOIDC: false
Fix Tailscale operator PodSecurity issues - Change namespace from enforce:restricted to warn:restricted to allow operator to run without PodSecurity blocking - Remove runAsUser:0 from operator as it's no longer needed - This allows the Tailscale operator to run with its default configuration
2026-05-04 03:02:09 +00:00
podSecurityContext: {}
Fix Tailscale operator: add securityContext for PodSecurity restricted policy The merged PR was missing securityContext/podSecurityContext values required by the namespace's restricted:latest PodSecurity policy. Without these, pods fail to create with FailedCreate errors.
2026-05-04 02:26:09 +00:00
securityContext:
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
webhook:
enabled: false
Reference in a new issue Copy permalink