sirius/gcloud-lab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
828 commits 1 branch 0 tags 1.5 MiB
Commit graph

828 commits

This branch
This branch
All branches
Author SHA1 Message Date
sirius0xdev
89e61cf53b fix: add namespace to ProxyGroups (customer1/monitoring) 2026-05-04 05:59:34 +00:00
sirius0xdev
84a4913b9a
Merge pull request #94 from sirius0xdev/feat/expose-grafana-dashboard 
feat: expose Grafana dashboard via Tailscale ProxyGroup
 2026-05-04 01:35:00 -04:00
sirius0xdev
804013d60f feat: expose Grafana dashboard via Tailscale ProxyGroup 2026-05-04 05:31:42 +00:00
sirius0xdev
6f985281c7
Merge pull request #93 from sirius0xdev/fix/tsproxy-to-proxygroup 
fix: correct ProxyGroup tag to tag:k8s-operator
 2026-05-04 01:26:37 -04:00
sirius0xdev
9391242ba2 fix: use correct tag:k8s-operator in rtx6000-brain ProxyGroup 2026-05-04 05:23:56 +00:00
sirius0xdev
6e58dc741b
Update kustomization.yaml 2026-05-04 00:55:38 -04:00
sirius0xdev
02da0a5d74
Merge pull request #92 from sirius0xdev/fix/tsproxy-to-proxygroup 
fix: replace non-existent TsProxy CRD with ProxyGroup
 2026-05-04 00:54:20 -04:00
sirius0xdev
ed39dcf598 fix: replace non-existent TsProxy CRD with ProxyGroup 
TsProxy is not a CRD shipped by the Tailscale operator (v1.96.x).
The operator provides: ProxyClass, ProxyGroup, ProxyGroupPolicy,
DNSConfig, Tailnet, Connector, and Recorder.

Replace TsProxy with ProxyGroup (type: ingress) and annotate
rtx6000-brain-service with tailscale.com/proxy-group to expose
the vLLM endpoint via MagicDNS at rtx6000-brain-0.<tailnet>.ts.net:8000.
 2026-05-04 04:47:34 +00:00
sirius0xdev
f8ed765bee
Update kustomization.yaml 2026-05-04 00:15:26 -04:00
sirius0xdev
69db1cf1f2 Remove invalid Tailscale operator tags 
The tag:k8s-operator and tag:tailnet tags don't exist in tailnet ACLs,
causing 400 errors on key creation. Set tags to empty for now.
 2026-05-04 03:59:08 +00:00
sirius0xdev
f30cb6e8fb fix secret 2026-05-04 03:52:25 +00:00
sirius0xdev
189b7a73d6 Fix Tailscale operator secret name to 'operator' 2026-05-04 03:20:46 +00:00
sirius0xdev
0b80ba0068 Remove SOPS-encrypted authkey secret from Kustomize 
Flux can't decrypt SOPS files in this setup. The secret will be
created manually on the cluster and won't be garbage collected by
Flux since it's not in the Kustomization resources.
 2026-05-04 03:10:50 +00:00
sirius0xdev
904152754d Add SOPS-encrypted Tailscale operator authkey secret 
Replaces manual secret creation with a repo-managed encrypted secret.
Decrypted value contains the operator authkey for tailscale login.
 2026-05-04 03:09:16 +00:00
sirius0xdev
28fc3202a3 Fix Tailscale operator PodSecurity issues 
- Change namespace from enforce:restricted to warn:restricted to allow operator to run without PodSecurity blocking
- Remove runAsUser:0 from operator as it's no longer needed
- This allows the Tailscale operator to run with its default configuration
 2026-05-04 03:02:09 +00:00
sirius0xdev
fbf3e4a55b Fix Tailscale operator: run as root (no longer needs restricted PodSecurity) 
The Tailscale operator requires /.config and root-level paths.
Namespace 'tailscale' had its pod-security.kubernetes.io/enforce label
removed, so runAsNonRoot is no longer required.
 2026-05-04 02:54:30 +00:00
sirius0xdev
0e60fff9a6 fix secret values 2026-05-04 02:53:03 +00:00
sirius0xdev
78c354bd72 Merge branch 'master' of github.com:sirius0xdev/gcloud-lab 
hhh#
 2026-05-04 02:46:43 +00:00
sirius0xdev
eb50df5356 fix secret key values 2026-05-04 02:46:37 +00:00
sirius0xdev
035ff4d428 Fix Tailscale operator: set runAsUser/runAsGroup for non-root image 
The tailscale/k8s-operator image runs as root by default, conflicting
with runAsNonRoot=true. Set runAsUser:65532 (nobody) to satisfy both
PodSecurity and container runtime.
 2026-05-04 02:36:59 +00:00
sirius0xdev
2ab4a78825 Fix Tailscale operator: add securityContext for PodSecurity restricted policy 
The merged PR was missing securityContext/podSecurityContext values
required by the namespace's restricted:latest PodSecurity policy.
Without these, pods fail to create with FailedCreate errors.
 2026-05-04 02:26:09 +00:00
sirius0xdev
21cebbc763 fix secret name in kustomization 2026-05-04 02:05:59 +00:00
sirius0xdev
80fe227e3c add dummy secret 2026-05-04 02:03:08 +00:00
sirius0xdev
b10ca9ab7d remove secret 2026-05-04 01:54:41 +00:00
sirius0xdev
59cd6af863
Merge pull request #91 from sirius0xdev/fix/tailscale-timeout 
Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity
 2026-05-03 21:47:36 -04:00
sirius0xdev
484d4f1d1f
Merge branch 'master' into fix/tailscale-timeout 2026-05-03 21:47:26 -04:00
sirius0xdev
6ca9871dfe
Merge pull request #89 from sirius0xdev/fix/age-key-encryption 
fix: re-encrypt authkey secret with correct age key
 2026-05-03 21:42:44 -04:00
sirius0xdev
116ac9ca48 Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity 
- Bump chart version 1.86.x -> 1.96.x
- Migrate operator: -> operatorConfig: (new chart structure)
- Disable OAuth/OIDC to use existing authkey secret
- Add securityContext for restricted:latest PodSecurity policy
- Add podSecurityContext.runAsNonRoot
- Drop ALL capabilities, disable privilege escalation
- Add RuntimeDefault seccomp profile
 2026-05-04 01:41:50 +00:00
sirius0xdev
b40ffc68cb update release 2026-05-04 01:17:40 +00:00
sirius0xdev
dc400a364d fix tsproxy issue 2026-05-04 01:09:48 +00:00
sirius0xdev
896ecc8c51 Merge branch 'master' of github.com:sirius0xdev/gcloud-lab 
i am the captain #
 2026-05-04 01:07:18 +00:00
sirius0xdev
3874014c85 fix kustomizations 2026-05-04 01:07:09 +00:00
sirius0xdev
69964e5cbc
Merge pull request #90 from sirius0xdev/fix/tailscale-timeout 
Fix/tailscale timeout
 2026-05-03 20:53:59 -04:00
sirius0xdev
503e8c4813
Merge branch 'master' into fix/age-key-encryption 2026-05-03 20:53:40 -04:00
sirius0xdev
bf4a2b260f fix: increase tailscale-operator HelmRelease timeout to 15m 2026-05-04 00:50:43 +00:00
sirius0xdev
2b6225c4e8 fix: increase tailscale-operator HelmRelease timeout to 10m (install was timing out) 2026-05-04 00:48:09 +00:00
sirius0xdev
852d2c76c1 fix: update tailscale operator authkey with fresh single-use key 2026-05-04 00:43:59 +00:00
sirius0xdev
caf08571c1 fix: re-encrypt authkey secret with correct age key 2026-05-04 00:41:27 +00:00
sirius0xdev
64bc378884
Merge pull request #88 from sirius0xdev/fix/remove-wait 
fix: remove wait: true from infrastructure-controllers (dependsOn + F…
 2026-05-03 20:36:45 -04:00
sirius0xdev
508c5c048e fix: remove wait: true from infrastructure-controllers (dependsOn + Flux retry is sufficient) 2026-05-04 00:35:52 +00:00
sirius0xdev
1e91fa71e8
Merge pull request #87 from sirius0xdev/fix/separate-monitoring-controllers 
fix: separate monitoring from controllers so broken prometheus-stack …
 2026-05-03 20:31:19 -04:00
sirius0xdev
61165c2b00 fix: separate monitoring from controllers so broken prometheus-stack doesn't block tailnet chain 2026-05-04 00:30:02 +00:00
sirius0xdev
f614d925de
Merge pull request #86 from sirius0xdev/temp-fix-wait 
fix(tailnet): add wait: true to infrastructure-controllers so HelmRel…
 2026-05-03 20:26:12 -04:00
sirius0xdev
88dd60498f fix(tailnet): add wait: true to infrastructure-controllers so HelmRelease completes before downstream dependsOn 2026-05-04 00:25:45 +00:00
sirius0xdev
d1cfb262c4
Merge pull request #85 from sirius0xdev/temp-fix 
fix(tailnet): move tsproxy-rtx6000.yaml into tailnet dir for Flux build
 2026-05-03 20:18:18 -04:00
sirius0xdev
5e3b34646c fix(tailnet): move tsproxy-rtx6000.yaml into tailnet dir for Flux build 2026-05-04 00:17:17 +00:00
sirius0xdev
9c322003f0
Merge pull request #84 from sirius0xdev/fix/tsproxy-depends-on-operator 
fix(tailnet): move TsProxy to separate Kustomization that depends on …
 2026-05-03 20:08:25 -04:00
sirius0xdev
83b70951c6 fix(tailnet): move TsProxy to separate Kustomization that depends on operator 
- Remove TsProxy from infrastructure-controllers to avoid CRD timing issue
- Create infrastructure/tailnet/ Kustomization for TsProxy resources
- Add infrastructure-tailnet Flux Kustomization with dependsOn
- Add dependsOn to customer1 Kustomization for trade-dashboard TsProxy
 2026-05-04 00:06:51 +00:00
sirius0xdev
c8d54c68d7
Merge pull request #83 from sirius0xdev/feat/tailscale-operator-authkey-tsproxy 
feat(tailscale): add operator authkey secret and rtx6000-brain TsProxy
 2026-05-03 20:02:09 -04:00
sirius0xdev
5f9b55af55 feat(tailscale): add operator authkey secret and rtx6000-brain TsProxy 
- Add SOPS-encrypted tailscale-operator-authkey secret for operator auth
- Add TsProxy to expose rtx6000-brain-service on tailnet (port 8000)
- Enable trade-dashboard TsProxy (was waiting for operator install)
 2026-05-03 23:30:28 +00:00