From 2ab4a788256312f7bcd65aec4a18c402309a6cc8 Mon Sep 17 00:00:00 2001
From: sirius0xdev <sirius0xdev@users.noreply.github.com>
Date: Mon, 4 May 2026 02:26:09 +0000
Subject: [PATCH] Fix Tailscale operator: add securityContext for PodSecurity
 restricted policy

The merged PR was missing securityContext/podSecurityContext values
required by the namespace's restricted:latest PodSecurity policy.
Without these, pods fail to create with FailedCreate errors.
---
 .../base/tailscale/release-operator.yaml        | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/infrastructure/controllers/base/tailscale/release-operator.yaml b/infrastructure/controllers/base/tailscale/release-operator.yaml
index a96510a..079f858 100644
--- a/infrastructure/controllers/base/tailscale/release-operator.yaml
+++ b/infrastructure/controllers/base/tailscale/release-operator.yaml
@@ -22,17 +22,24 @@ spec:
   upgrade:
     crds: CreateReplace
   values:
-    # Operator configuration
     operatorConfig:
-      # Tag to use for pods created by the operator (e.g., tailnet)
       tags: [tailnet]
-      # Auth key from secret - PLACEHOLDER, replace with real key
       operatorSecretRef:
         name: tailscale-operator-authkey
         key: authkey
       logFile: "/var/log/tailscale.log"
-      # Don't block pod startup if Tailscale auth fails
       waitForLinkLocal: false
-    # Disable webhook (optional)
+      useOAuth: false
+      useOIDC: false
+      podSecurityContext:
+        runAsNonRoot: true
+      securityContext:
+        allowPrivilegeEscalation: false
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+        capabilities:
+          drop:
+            - ALL
     webhook:
       enabled: false