From 035ff4d428b060b17e9fcaea6086002b24449357 Mon Sep 17 00:00:00 2001
From: sirius0xdev <sirius0xdev@users.noreply.github.com>
Date: Mon, 4 May 2026 02:36:59 +0000
Subject: [PATCH] Fix Tailscale operator: set runAsUser/runAsGroup for non-root
 image

The tailscale/k8s-operator image runs as root by default, conflicting
with runAsNonRoot=true. Set runAsUser:65532 (nobody) to satisfy both
PodSecurity and container runtime.
---
 infrastructure/controllers/base/tailscale/release-operator.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/infrastructure/controllers/base/tailscale/release-operator.yaml b/infrastructure/controllers/base/tailscale/release-operator.yaml
index 079f858..f975868 100644
--- a/infrastructure/controllers/base/tailscale/release-operator.yaml
+++ b/infrastructure/controllers/base/tailscale/release-operator.yaml
@@ -33,6 +33,8 @@ spec:
       useOIDC: false
       podSecurityContext:
         runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
       securityContext:
         allowPrivilegeEscalation: false
         runAsNonRoot: true