From 116ac9ca4895143aeeb6876da138c145c1823a2a Mon Sep 17 00:00:00 2001
From: sirius0xdev <sirius0xdev@users.noreply.github.com>
Date: Mon, 4 May 2026 01:41:50 +0000
Subject: [PATCH] Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity

- Bump chart version 1.86.x -> 1.96.x
- Migrate operator: -> operatorConfig: (new chart structure)
- Disable OAuth/OIDC to use existing authkey secret
- Add securityContext for restricted:latest PodSecurity policy
- Add podSecurityContext.runAsNonRoot
- Drop ALL capabilities, disable privilege escalation
- Add RuntimeDefault seccomp profile
---
 .../base/tailscale/release-operator.yaml      | 33 +++++++++++--------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/infrastructure/controllers/base/tailscale/release-operator.yaml b/infrastructure/controllers/base/tailscale/release-operator.yaml
index 94e73d8..903dc5e 100644
--- a/infrastructure/controllers/base/tailscale/release-operator.yaml
+++ b/infrastructure/controllers/base/tailscale/release-operator.yaml
@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: tailscale-operator
-      version: "1.86.x"
+      version: "1.96.x"
       sourceRef:
         kind: HelmRepository
         name: tailscale
@@ -23,19 +23,26 @@ spec:
     crds: CreateReplace
   values:
     # Operator configuration
-    operator:
+    operatorConfig:
       # Tag to use for pods created by the operator (e.g., tailnet)
-      tags: []
-      # Auth key from secret - PLACEHOLDER, replace with real key
-      # Create secret: kubectl create secret generic tailscale-operator-authkey \
-      #   -n tailscale --from-literal=authkey=tskey-abc123... \
-      #   --dry-run=client -o yaml | kubectl apply -n tailscale
-      operatorSecretRef:
-        name: tailscale-operator-authkey
-        key: authkey
-      logFile: "/var/log/tailscale.log"
-      # Don't block pod startup if Tailscale auth fails
-      waitForLinkLocal: false
+      hostname: "tailscale-operator"
+      # Auth key via existing secret
+      useOAuth: false
+      useOIDC: false
+      # Concurrency
+      tailscaleOperator:
+        setConcurrentResourceReconciles: 2
+      # PodSecurity "restricted:latest" compliance
+      podSecurityContext:
+        runAsNonRoot: true
+      securityContext:
+        allowPrivilegeEscalation: false
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+        capabilities:
+          drop:
+            - ALL
     # Disable webhook (optional)
     webhook:
       enabled: false