Merge branch 'master' into fix/tailscale-timeout

2026-05-03 21:47:26 -04:00 · 2026-05-03 21:47:26 -04:00 · 484d4f1d1f
commit 484d4f1d1f
parent 116ac9ca48 6ca9871dfe
7 changed files with 49 additions and 43 deletions
--- a/apps/base/customer1/trade-dashboard/kustomization.yaml
+++ b/apps/base/customer1/trade-dashboard/kustomization.yaml
@ -5,4 +5,4 @@ resources:
  - deployment.yaml
  - service.yaml
  - configmap.yaml
-  - tsproxy.yaml
+#  - tsproxy.yaml
--- a/clusters/devops-lab/infra-tailnet.yaml
+++ b/clusters/devops-lab/infra-tailnet.yaml
--- a/infrastructure/controllers/base/tailscale/authkey-secret.enc.yaml
+++ b/infrastructure/controllers/base/tailscale/authkey-secret.enc.yaml
@ -1,23 +1,14 @@
-apiVersion: ENC[AES256_GCM,data:NRg=,iv:wrgkO2zumRTaYoJc7d38N7KXS9hizgiCktfx2kZmyxU=,tag:oxNtxWk/WicjsJw5+51XNg==,type:str]
-kind: ENC[AES256_GCM,data:ohOFcU5u,iv:8XyF9v76sLNYcDWy2UjzJtvdaKFRTiE0AMk2sRwOpJ0=,tag:phU5QersOFVTepljv4fGQg==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:oYmF2OCKGTLEc+5aFxS39K1+o2lIePVObhY=,iv:ioxTqEYNlDMYBnhcVrmHBQIWG3k4Cz5/U2LGaYJi3/4=,tag:REV5zmMtImFjybgzS5/25A==,type:str]
-    namespace: ENC[AES256_GCM,data:kRVxhUT082MC,iv:AXgqD5uhs5VJIC8M8CkDE1gmfj3E1lCw3RhYjEXsWA8=,tag:ecKc+ET3JAQv5Rq5nquv0w==,type:str]
-type: ENC[AES256_GCM,data:/DflUxxJ,iv:WIenl85o8aA8FwDEwXGJmUAzh0Mjdxes66MZLw15g3k=,tag:l1HZJWrXFUc86BNnBxm5MQ==,type:str]
-stringData:
-    authkey: ENC[AES256_GCM,data:VlCpY1j6y6Rcz22FFMO5BeBK80hvhPItZBm2SPZI7Q5p4eTUKoQlZHYc5Dq0/VcKju8aHtU5UXphi0OBLg==,iv:vJ1BlK8JvKqvgIUZdasZ/0Ufyc1K39kOMpT2ZIFk29A=,tag:IuTAzrokpVMlL0gCnCAVRg==,type:str]
-sops:
-    age:
-        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiZUFlY0tDT0lxV1NHZlpq
-            dWZWbkpLK3BVNk5qK2o3UFQrMVZnZjFLaHlNCmo0c3BKWk82QnZJYnVEdVRtWG9T
-            SkNtRCt1NmN2L0tGRUlCUXljTkNES28KLS0tIGlFTUZpUXF6R0hRTmZVR2RIbUJj
-            OGlPanpOOW4yeHRCUHpNSE1HT2V6UDgKgTybnkXVnkmutKCpzlnMDSjbGXLJQEM3
-            Ipwj8jd8lKQG51/qFaHwwoMnHaVagFFKGsL8u4N2aiogag356qgwuw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-04T00:43:53Z"
-    mac: ENC[AES256_GCM,data:GkyA+glJn3u998iel1/HCxXRYEao7xf8NWYVSYwpaHvnVSAIG90aQhuT+hvPdzTVqd0PW3OIFu7658nBgRUvL3a68PS2rVPvJerzelnqrsMsqgBrDs7irZ+X2p+pio3NQgyCG6JQPFuuc4oFAFDo/NzNNxE/pGFn6zUkzMnfk1g=,iv:FTa1+YYYI2OHNFHZcqrY3gpQYxbX0mtxtLD7UM/TsgY=,tag:XtWrUWRUzbQjiEEAsyYurg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2
+{
+	"data" : "ENC[AES256_GCM,data:wnrfqw7ClV7ShqtOwPH6sylxB0/5QpwSp1cMp2V68WvqXowEhV5yXGCYwUuz+W9x4rYO5rCVlRqP7Ch0uEUrVAx8gBbGGDN9CnG56hkI9A7BC5Ozia7nOyleTLxiPrnC7eMBomDzx1B7jcAb8UsdflMm9wjzhCtVNvyNesyb1Q/N8WHOqPt9nVIWPHNAnLGCNSPevl3VlvNZIE484CBP8sPITQ35jJHRixyXCxYii0Oknt44waiv00LATuhrw00a8sPyGc9Dww7InIRVHQ7T2RDv4PpiHJ7eLi+OAq8+WKTA1CFEU1mhXAvdog2dvRN4bjYabI/2mzOUvX58PPbz9t9f6GHHUhK/SBGWTe5/4qn29RJ/ShKrvsj1C3qNoMjKLhiXpMAm5zobvzQi5OFdRbDJvtiuTh2CTTcye9turvCTvA35vou5dsbL50Y2EUbepz9QZTts8IJqPoRz9+mffZec8fKLRCCKd/ikgzIRpsTWymNN85LFgHzDlybUi8UWvpadFJMwDx3QAYhZHGSVhK66HnPVBPwrmci727YaizEe7i2CEPmYhLoqqC3/9SsDolvTnohEU7h/y1CL8TTyV79S0jOAF443u1reZ/mNR1lWIsnZtneJVT8tfhGtnTg9SDGwip1jZJtbSZb+3RG6cIJMFefLr8ATHy2foIzAUdUBDknrIVjMuLpBQ4mZ8KQ34yj2zqVMsg3DTiifdTkcy2PXMgMOQ3v3PM/kokZ0Qb4FEcRTtvW2FLTIE6B8JdNe3X8oe+uti/Fk3uDtKZ5xvaJYl3jlODPEulQeHT+3Q7axFoBrHbDvjfkcmtJWCXVajlrM6SruJngnQ5LXAC2/IyL5hNAEmJrvC2kUgkucnW1LzRL6buyPlYJOxI//MC0aQVAfYj4bboEYz6/DuYzoQ+yc8u+Th+FEqCCifhKbB3to33R0Gum7793naETahm5EqY+cju9znq9CnZnOaNO5yjWszVgFVr/fn2vKtBA+AL2QPZ8gb6q1GuqoRCjE1DI04ivf6vCzE6EWbqBW/TGuTGFSVjHxhABJczToFaBTfhXzsw9QfZBnyY9W1MYT9jOtW2rCGBIrIKhr8y4rSVjgYOMn/nR3wiKGz522auSTHwJmU/nRZ2Tmdgb6UBWlYrgobyll0PozfutkHkp71HKPgvxUV2Y+8FLNeq1bvOe0Yu6KFatpPkK/6n1B6zP96xdkQ9f12RCpFOUIj8Cr2pZYl5HUzeQ3E1lVEaesWm3UEF8Jj+9VhOLvDSxfUJM+EVyc89SKbECDGn8f/5ZSD/3DW6BTn+eBN8M9xpDdZkSq8RTPH7OfNQfD1ubz/k8GqjNgBMBUhRt4IvmucNu0hqN66CQrztBei9K8/7gVZkH89dHhGlgN+VTws4c/Netb5c1LoBvh+zihlZOxlvT2n96OxqaTk4XWl7YWaSondUeXZzte7Uc3pfLTYnf747KA6cORlDtKVs9oLt/WADjSR66VPPwBpCYp1RpG6lb/KWy9BurjimTVi96qC9B7C7evy7Pcw7yjPke/N7cTMupN+UQL2xPNZEHOJct3/Q/25cM/+suC4yL7LZKlknlRz8uRtUFtDUtUoh9lVcvC7PL0SU1hxotgCjhx4AsO1TJEeJTT2rdMrnPKT7s7DdaI7bp8BrYsMtpULSGYb+1tGEvjQ5547/DUjLWVSwLUGdf4mFbrSk7vYocEWb/dFTy97RbirYWIEnkB3nObjKnvtdWctNpgWeo/mkY53KNtQTGpuwyqaLiamRU/mVDrH/ljGaSJ5DSxCYXtb6SLDJT+XrV1AUPd7YNT87EA5H5aKpUYE/P8M6iXcpp96jjPjs17kdHwtT/My3VxLwb3c4cUMgW1ReuEduzMchYiW4FzQ3r/RG+JlVMSukLM8RK1KP/dWKxiPkBzEsY/Ouj0wTe75Q2+sKwhH9MSxir0SKTKB+Kbxgd5/Vm7YiDHG6/F4vfEPlXk3qHRllZE5vMlFU/0UrGNBVdVCHmDo3yScXipZUouPbY8eYBtaFgkE2WB6fxMQoi0euRFZWeaxfw6dN4sBs68Zc0GLHDx5SAAi5SxAtb0NM9HRIQspO8CqgsmxVIBhuj7zH70kUsCL2mfv/fo8M8KIyYUMclsdP7FzsgfmxaBePcblSi8KeTzkI7NsLsZ7acPehiZnnECX45v162aG3rYZWAjY3i3LZFXh0OoT+SlVVYxzS40LYoAIpUWfQWHrbWcRI3wQAGF3vUgG25cjE33HOEY8cA1YspeV4324WriJe+UBjLdwz+XljG+VNu9AU8hnhB3YlpY+EWF9cSzZ6GQ1mpPm2CjSmF18UDMn8lpR2tiRWiFNPuMxdptVDh/dHE/tZ1rVa/aje9ORx7F1CiN3VU7wwoxQSj6y1wRrFSByreTjTpAbSt9pmAr4l8DJS9ZGKFaaJLwpTtUwEgwIj45RCDos/PmplLGhWYwJEKhi+N2H0E=,iv:Usj+HX0mV48cv5CQ8N5zeseNYeX7v4JySSjfjbKGSbU=,tag:KOVZqnW+bL6kTK79qn1AJA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsbHFIT1F2S3M1Yzk4Wisz\nOU80N0kxT1llQ3pTYjZweEhuaHNvditIem5jCk5KWTVnRmhWTzVNM3ZYYzlKT1R3\nKzVhbFhIL2N1a2Y0Uk5EVlJKVmFIMEkKLS0tIEs3cHAweC94bzVWaUhyekxKNWx5\nbHF3OHlOTEdPejc0cDFjRTVZLzlKTTgKBrP9XqTbaOzEzRv321EcY4mRVF3Eh2is\nNMVNEXa06Kij6nSSyzn6xLNlqhTdx8aGmxaLB0SkWiTtvHFidNVKgw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-05-04T00:41:23Z",
+		"mac": "ENC[AES256_GCM,data:wBSb4LzfXDk3hdRk7o1HUBlpnpb8Ry5icBE0CKl0oj1WLhaH/n4JuWF4nIaYb/9caJGqrwNvwkw38ivJMfRWvU79wANc/1KoNaRFsA3b9Gb+hyXl9yMi7gD5N11rxc3XPzUqlWs69QvLUvx09hPbmx/9Jhl/K7GvTi+W7/vVm5A=,iv:jAwJe5rOSj8tK7jyHw1y4C8ooTbsrfcr5vkQsYq4ukQ=,tag:YYIOfjjvOipzJ9lz3vFaPg==,type:str]",
+		"version": "3.12.2"
+	}
+}
--- a/infrastructure/controllers/base/tailscale/authkey-secret.enc.yaml.bak
+++ b/infrastructure/controllers/base/tailscale/authkey-secret.enc.yaml.bak
@ -0,0 +1,23 @@
+apiVersion: ENC[AES256_GCM,data:R/0=,iv:PUqVQ0H2SZdXZkCiaSdz0ysy7wTTtE1+v25UqgXdX1c=,tag:j6+gB/gKyxuXBrsjt7OsHQ==,type:str]
+kind: ENC[AES256_GCM,data:p+MMCOMS,iv:rCfu2I31ot6oCqIHcr3FwimOYl2qDpifkTaCZmN3Ah0=,tag:dikURqRMZDS7m7kdbefa7w==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:6VEI/ZBaa3RmcuNNt8GRLanuvReC8P3FUSc=,iv:AI4A5cN20JV7Qdb/POLrJH3BUpfpAb9ybu6rABSEy/Q=,tag:fGZi0hQFpmT5jOnvVTvXvw==,type:str]
+    namespace: ENC[AES256_GCM,data:RvEu7ZA3W64Y,iv:wP45Ik04OW8Qz6DnyO3zymQMEQvJOyshTgVvLkqPUbU=,tag:PrdXhIVgnjRCNvv0c2uXGg==,type:str]
+type: ENC[AES256_GCM,data:X8Eu6/NT,iv:c6vQILIOdMZBJOzfDxOBfMZjBKyxgtHOCj6CIB9Mssc=,tag:3K38oNZpBzroLKetuFHSYQ==,type:str]
+stringData:
+    authkey: ENC[AES256_GCM,data:6bfaUzy0icgmy7panoJAIMtdhMl55ClYGi+VmBlnwrYTo1z5Cs18C0HAMozFDaevfGbaFGtEdmsyZVPKjg==,iv:g8z8QwCDA/IuUFGYNzyKW/MgqCZfaRWfWlTk65Hsvdc=,tag:irs0M4aUL35WdYUD+o2aCg==,type:str]
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFY1Vjd1p3M2Q4eFkwdE5i
+            SExndHAxSTByZmZYd0ZpS21DY1VGZlJxNVZnCllYcGpCY05FUzdXVXVuMHAreGMy
+            b0FDRCsxNmprQ0xZRlFKYjFCMW9MSVkKLS0tIDJBR0hwaXFBb3VMS0pta29nRWpv
+            di9LZ2NRMnhTT3RmZzgrbUV6eGNKVTgKpPITr4gtgEd+Sb4bqkBdGrHfmmSxp3pU
+            sA61aRNncplQRqcYiupDlxddM25kLgK95igM0D9bZMnf98esaMW0tQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-03T23:29:13Z"
+    mac: ENC[AES256_GCM,data:gdqeJQuzRC58jNwISj/UXrYFTy1HrgG1Br5bTUZ/4WT0fyraVlKyPcnl6GO7Ljf1YH8ZYeOnCDqA31/ufJuILUuTiGT77qtPRHgXy0AGtlcdFoXcSrqDUGDjyfMupCgAZGviEaIWARau1cN1/jO+IFnhTcCaAYF4sykc1k3QU3o=,iv:nzYIC1WqDijUeo/v/K1rxp/b4UgvsvEdNzcN7D0n5YQ=,tag:k7+I9dMRg+AMnCF0Zog9pg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2
--- a/infrastructure/controllers/base/tailscale/kustomization.yaml
+++ b/infrastructure/controllers/base/tailscale/kustomization.yaml
@ -5,3 +5,5 @@ resources:
  - repository.yaml
  - release-operator.yaml
  - authkey-secret.enc.yaml
+ # - tsproxy-rtx6000.yaml 
+  
--- a/infrastructure/controllers/base/tailscale/release-operator.yaml
+++ b/infrastructure/controllers/base/tailscale/release-operator.yaml
@ -25,24 +25,14 @@ spec:
    # Operator configuration
    operatorConfig:
      # Tag to use for pods created by the operator (e.g., tailnet)
-      hostname: "tailscale-operator"
-      # Auth key via existing secret
-      useOAuth: false
-      useOIDC: false
-      # Concurrency
-      tailscaleOperator:
-        setConcurrentResourceReconciles: 2
-      # PodSecurity "restricted:latest" compliance
-      podSecurityContext:
-        runAsNonRoot: true
-      securityContext:
-        allowPrivilegeEscalation: false
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-        capabilities:
-          drop:
-            - ALL
+      tags: [tailnet]
+      # Auth key from secret - PLACEHOLDER, replace with real key
+      operatorSecretRef:
+        name: tailscale-operator-authkey
+        key: authkey
+      logFile: "/var/log/tailscale.log"
+      # Don't block pod startup if Tailscale auth fails
+      waitForLinkLocal: false
    # Disable webhook (optional)
    webhook:
      enabled: false
--- a/infrastructure/tailnet/kustomization.yaml
+++ b/infrastructure/tailnet/kustomization.yaml
@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - tsproxy-rtx6000.yaml
+  - tsproxy-rtx6000.yaml