From fbf3e4a55bc07eebf2c3ed3b7e480629ab5136f6 Mon Sep 17 00:00:00 2001
From: sirius0xdev <sirius0xdev@users.noreply.github.com>
Date: Mon, 4 May 2026 02:54:27 +0000
Subject: [PATCH] Fix Tailscale operator: run as root (no longer needs
 restricted PodSecurity)

The Tailscale operator requires /.config and root-level paths.
Namespace 'tailscale' had its pod-security.kubernetes.io/enforce label
removed, so runAsNonRoot is no longer required.
---
 .../controllers/base/tailscale/release-operator.yaml         | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/infrastructure/controllers/base/tailscale/release-operator.yaml b/infrastructure/controllers/base/tailscale/release-operator.yaml
index f975868..1f68ce0 100644
--- a/infrastructure/controllers/base/tailscale/release-operator.yaml
+++ b/infrastructure/controllers/base/tailscale/release-operator.yaml
@@ -32,12 +32,9 @@ spec:
       useOAuth: false
       useOIDC: false
       podSecurityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
+        runAsUser: 0
       securityContext:
         allowPrivilegeEscalation: false
-        runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
         capabilities: