sirius/gcloud-lab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
gcloud-lab/infrastructure/controllers/base/tailscale/release-operator.yaml

49 lines
1.1 KiB
YAML
Raw Normal View History

feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: tailscale-operator
namespace: tailscale
spec:
interval: 1h
fix: increase tailscale-operator HelmRelease timeout to 15m
2026-05-04 00:50:43 +00:00
timeout: 15m
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
chart:
spec:
chart: tailscale-operator
Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity - Bump chart version 1.86.x -> 1.96.x - Migrate operator: -> operatorConfig: (new chart structure) - Disable OAuth/OIDC to use existing authkey secret - Add securityContext for restricted:latest PodSecurity policy - Add podSecurityContext.runAsNonRoot - Drop ALL capabilities, disable privilege escalation - Add RuntimeDefault seccomp profile
2026-05-04 01:41:50 +00:00
version: "1.96.x"
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
sourceRef:
kind: HelmRepository
name: tailscale
namespace: tailscale
interval: 12h
targetNamespace: tailscale
install:
createNamespace: true
crds: Create
upgrade:
crds: CreateReplace
values:
# Operator configuration
Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity - Bump chart version 1.86.x -> 1.96.x - Migrate operator: -> operatorConfig: (new chart structure) - Disable OAuth/OIDC to use existing authkey secret - Add securityContext for restricted:latest PodSecurity policy - Add podSecurityContext.runAsNonRoot - Drop ALL capabilities, disable privilege escalation - Add RuntimeDefault seccomp profile
2026-05-04 01:41:50 +00:00
operatorConfig:
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
# Tag to use for pods created by the operator (e.g., tailnet)
Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity - Bump chart version 1.86.x -> 1.96.x - Migrate operator: -> operatorConfig: (new chart structure) - Disable OAuth/OIDC to use existing authkey secret - Add securityContext for restricted:latest PodSecurity policy - Add podSecurityContext.runAsNonRoot - Drop ALL capabilities, disable privilege escalation - Add RuntimeDefault seccomp profile
2026-05-04 01:41:50 +00:00
hostname: "tailscale-operator"
# Auth key via existing secret
useOAuth: false
useOIDC: false
# Concurrency
tailscaleOperator:
setConcurrentResourceReconciles: 2
# PodSecurity "restricted:latest" compliance
podSecurityContext:
runAsNonRoot: true
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
# Disable webhook (optional)
webhook:
enabled: false
Reference in a new issue Copy permalink