From 2ab4a788256312f7bcd65aec4a18c402309a6cc8 Mon Sep 17 00:00:00 2001
From: sirius0xdev <sirius0xdev@users.noreply.github.com>
Date: Mon, 4 May 2026 02:26:09 +0000
Subject: [PATCH 1/2] Fix Tailscale operator: add securityContext for
 PodSecurity restricted policy

The merged PR was missing securityContext/podSecurityContext values
required by the namespace's restricted:latest PodSecurity policy.
Without these, pods fail to create with FailedCreate errors.
---
 .../base/tailscale/release-operator.yaml        | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/infrastructure/controllers/base/tailscale/release-operator.yaml b/infrastructure/controllers/base/tailscale/release-operator.yaml
index a96510a..079f858 100644
--- a/infrastructure/controllers/base/tailscale/release-operator.yaml
+++ b/infrastructure/controllers/base/tailscale/release-operator.yaml
@@ -22,17 +22,24 @@ spec:
   upgrade:
     crds: CreateReplace
   values:
-    # Operator configuration
     operatorConfig:
-      # Tag to use for pods created by the operator (e.g., tailnet)
       tags: [tailnet]
-      # Auth key from secret - PLACEHOLDER, replace with real key
       operatorSecretRef:
         name: tailscale-operator-authkey
         key: authkey
       logFile: "/var/log/tailscale.log"
-      # Don't block pod startup if Tailscale auth fails
       waitForLinkLocal: false
-    # Disable webhook (optional)
+      useOAuth: false
+      useOIDC: false
+      podSecurityContext:
+        runAsNonRoot: true
+      securityContext:
+        allowPrivilegeEscalation: false
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+        capabilities:
+          drop:
+            - ALL
     webhook:
       enabled: false

From 035ff4d428b060b17e9fcaea6086002b24449357 Mon Sep 17 00:00:00 2001
From: sirius0xdev <sirius0xdev@users.noreply.github.com>
Date: Mon, 4 May 2026 02:36:59 +0000
Subject: [PATCH 2/2] Fix Tailscale operator: set runAsUser/runAsGroup for
 non-root image

The tailscale/k8s-operator image runs as root by default, conflicting
with runAsNonRoot=true. Set runAsUser:65532 (nobody) to satisfy both
PodSecurity and container runtime.
---
 infrastructure/controllers/base/tailscale/release-operator.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/infrastructure/controllers/base/tailscale/release-operator.yaml b/infrastructure/controllers/base/tailscale/release-operator.yaml
index 079f858..f975868 100644
--- a/infrastructure/controllers/base/tailscale/release-operator.yaml
+++ b/infrastructure/controllers/base/tailscale/release-operator.yaml
@@ -33,6 +33,8 @@ spec:
       useOIDC: false
       podSecurityContext:
         runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
       securityContext:
         allowPrivilegeEscalation: false
         runAsNonRoot: true