From 28fc3202a3f0e29a2f5520d050b7be9c004bc222 Mon Sep 17 00:00:00 2001
From: sirius0xdev <sirius0xdev@users.noreply.github.com>
Date: Mon, 4 May 2026 03:02:09 +0000
Subject: [PATCH] Fix Tailscale operator PodSecurity issues

- Change namespace from enforce:restricted to warn:restricted to allow operator to run without PodSecurity blocking
- Remove runAsUser:0 from operator as it's no longer needed
- This allows the Tailscale operator to run with its default configuration
---
 infrastructure/controllers/base/tailscale/namespace.yaml       | 3 ++-
 .../controllers/base/tailscale/release-operator.yaml           | 3 +--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/infrastructure/controllers/base/tailscale/namespace.yaml b/infrastructure/controllers/base/tailscale/namespace.yaml
index 0049a09..9f240f9 100644
--- a/infrastructure/controllers/base/tailscale/namespace.yaml
+++ b/infrastructure/controllers/base/tailscale/namespace.yaml
@@ -3,4 +3,5 @@ kind: Namespace
 metadata:
   name: tailscale
   labels:
-    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest
diff --git a/infrastructure/controllers/base/tailscale/release-operator.yaml b/infrastructure/controllers/base/tailscale/release-operator.yaml
index 1f68ce0..2c35c44 100644
--- a/infrastructure/controllers/base/tailscale/release-operator.yaml
+++ b/infrastructure/controllers/base/tailscale/release-operator.yaml
@@ -31,8 +31,7 @@ spec:
       waitForLinkLocal: false
       useOAuth: false
       useOIDC: false
-      podSecurityContext:
-        runAsUser: 0
+      podSecurityContext: {}
       securityContext:
         allowPrivilegeEscalation: false
         seccompProfile: