sirius/gcloud-lab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
gcloud-lab/infrastructure/controllers/base/tailscale/release-operator.yaml

39 lines
959 B
YAML
Raw Normal View History

feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: tailscale-operator
namespace: tailscale
spec:
interval: 1h
fix: increase tailscale-operator HelmRelease timeout to 15m
2026-05-04 00:50:43 +00:00
timeout: 15m
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
chart:
spec:
chart: tailscale-operator
Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity - Bump chart version 1.86.x -> 1.96.x - Migrate operator: -> operatorConfig: (new chart structure) - Disable OAuth/OIDC to use existing authkey secret - Add securityContext for restricted:latest PodSecurity policy - Add podSecurityContext.runAsNonRoot - Drop ALL capabilities, disable privilege escalation - Add RuntimeDefault seccomp profile
2026-05-04 01:41:50 +00:00
version: "1.96.x"
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
sourceRef:
kind: HelmRepository
name: tailscale
namespace: tailscale
interval: 12h
targetNamespace: tailscale
install:
createNamespace: true
crds: Create
upgrade:
crds: CreateReplace
values:
# Operator configuration
Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity - Bump chart version 1.86.x -> 1.96.x - Migrate operator: -> operatorConfig: (new chart structure) - Disable OAuth/OIDC to use existing authkey secret - Add securityContext for restricted:latest PodSecurity policy - Add podSecurityContext.runAsNonRoot - Drop ALL capabilities, disable privilege escalation - Add RuntimeDefault seccomp profile
2026-05-04 01:41:50 +00:00
operatorConfig:
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
# Tag to use for pods created by the operator (e.g., tailnet)
update release
2026-05-04 01:17:40 +00:00
tags: [tailnet]
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
# Auth key from secret - PLACEHOLDER, replace with real key
operatorSecretRef:
name: tailscale-operator-authkey
key: authkey
logFile: "/var/log/tailscale.log"
# Don't block pod startup if Tailscale auth fails
waitForLinkLocal: false
# Disable webhook (optional)
webhook:
enabled: false
Reference in a new issue Copy permalink