sirius/gcloud-lab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
gcloud-lab/infrastructure/controllers/base/tailscale/release-operator.yaml

45 lines
971 B
YAML
Raw Normal View History

feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: tailscale-operator
namespace: tailscale
spec:
interval: 1h
fix: increase tailscale-operator HelmRelease timeout to 15m
2026-05-04 00:50:43 +00:00
timeout: 15m
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
chart:
spec:
chart: tailscale-operator
Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity - Bump chart version 1.86.x -> 1.96.x - Migrate operator: -> operatorConfig: (new chart structure) - Disable OAuth/OIDC to use existing authkey secret - Add securityContext for restricted:latest PodSecurity policy - Add podSecurityContext.runAsNonRoot - Drop ALL capabilities, disable privilege escalation - Add RuntimeDefault seccomp profile
2026-05-04 01:41:50 +00:00
version: "1.96.x"
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
sourceRef:
kind: HelmRepository
name: tailscale
namespace: tailscale
interval: 12h
targetNamespace: tailscale
install:
createNamespace: true
crds: Create
upgrade:
crds: CreateReplace
values:
Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity - Bump chart version 1.86.x -> 1.96.x - Migrate operator: -> operatorConfig: (new chart structure) - Disable OAuth/OIDC to use existing authkey secret - Add securityContext for restricted:latest PodSecurity policy - Add podSecurityContext.runAsNonRoot - Drop ALL capabilities, disable privilege escalation - Add RuntimeDefault seccomp profile
2026-05-04 01:41:50 +00:00
operatorConfig:
update release
2026-05-04 01:17:40 +00:00
tags: [tailnet]
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
operatorSecretRef:
name: tailscale-operator-authkey
key: authkey
logFile: "/var/log/tailscale.log"
waitForLinkLocal: false
Fix Tailscale operator: add securityContext for PodSecurity restricted policy The merged PR was missing securityContext/podSecurityContext values required by the namespace's restricted:latest PodSecurity policy. Without these, pods fail to create with FailedCreate errors.
2026-05-04 02:26:09 +00:00
useOAuth: false
useOIDC: false
podSecurityContext:
Fix Tailscale operator: run as root (no longer needs restricted PodSecurity) The Tailscale operator requires /.config and root-level paths. Namespace 'tailscale' had its pod-security.kubernetes.io/enforce label removed, so runAsNonRoot is no longer required.
2026-05-04 02:54:27 +00:00
runAsUser: 0
Fix Tailscale operator: add securityContext for PodSecurity restricted policy The merged PR was missing securityContext/podSecurityContext values required by the namespace's restricted:latest PodSecurity policy. Without these, pods fail to create with FailedCreate errors.
2026-05-04 02:26:09 +00:00
securityContext:
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
feat: add Prometheus, Grafana, and Tailscale monitoring stack - Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress) - Deploy Tailscale Operator for secure VPN access to internal services - Add CNPG/PostgreSQL monitoring dashboards - Add vLLM inference monitoring dashboards (tokens, latency, GPU) - Add Cilium networking dashboards (policy, traffic, drops) - Update infra-controllers staging kustomization to include all controllers - Add monitoring-configs Flux sync for dashboard deployment - Update README with monitoring architecture and access instructions - Remove broken stale monitoring files (Azure Key Vault refs, wrong domains) Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
webhook:
enabled: false
Reference in a new issue Copy permalink