sirius0xdev
69db1cf1f2
Remove invalid Tailscale operator tags
...
The tag:k8s-operator and tag:tailnet tags don't exist in tailnet ACLs,
causing 400 errors on key creation. Set tags to empty for now.
2026-05-04 03:59:08 +00:00
sirius0xdev
189b7a73d6
Fix Tailscale operator secret name to 'operator'
2026-05-04 03:20:46 +00:00
sirius0xdev
28fc3202a3
Fix Tailscale operator PodSecurity issues
...
- Change namespace from enforce:restricted to warn:restricted to allow operator to run without PodSecurity blocking
- Remove runAsUser:0 from operator as it's no longer needed
- This allows the Tailscale operator to run with its default configuration
2026-05-04 03:02:09 +00:00
sirius0xdev
fbf3e4a55b
Fix Tailscale operator: run as root (no longer needs restricted PodSecurity)
...
The Tailscale operator requires /.config and root-level paths.
Namespace 'tailscale' had its pod-security.kubernetes.io/enforce label
removed, so runAsNonRoot is no longer required.
2026-05-04 02:54:30 +00:00
sirius0xdev
035ff4d428
Fix Tailscale operator: set runAsUser/runAsGroup for non-root image
...
The tailscale/k8s-operator image runs as root by default, conflicting
with runAsNonRoot=true. Set runAsUser:65532 (nobody) to satisfy both
PodSecurity and container runtime.
2026-05-04 02:36:59 +00:00
sirius0xdev
2ab4a78825
Fix Tailscale operator: add securityContext for PodSecurity restricted policy
...
The merged PR was missing securityContext/podSecurityContext values
required by the namespace's restricted:latest PodSecurity policy.
Without these, pods fail to create with FailedCreate errors.
2026-05-04 02:26:09 +00:00
sirius0xdev
484d4f1d1f
Merge branch 'master' into fix/tailscale-timeout
2026-05-03 21:47:26 -04:00
sirius0xdev
116ac9ca48
Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity
...
- Bump chart version 1.86.x -> 1.96.x
- Migrate operator: -> operatorConfig: (new chart structure)
- Disable OAuth/OIDC to use existing authkey secret
- Add securityContext for restricted:latest PodSecurity policy
- Add podSecurityContext.runAsNonRoot
- Drop ALL capabilities, disable privilege escalation
- Add RuntimeDefault seccomp profile
2026-05-04 01:41:50 +00:00
sirius0xdev
b40ffc68cb
update release
2026-05-04 01:17:40 +00:00
sirius0xdev
bf4a2b260f
fix: increase tailscale-operator HelmRelease timeout to 15m
2026-05-04 00:50:43 +00:00
sirius0xdev
2b6225c4e8
fix: increase tailscale-operator HelmRelease timeout to 10m (install was timing out)
2026-05-04 00:48:09 +00:00
Hermes Agent
6183159974
feat: add Prometheus, Grafana, and Tailscale monitoring stack
...
- Install Prometheus + Grafana via kube-prometheus-stack (ClusterIP only, no public ingress)
- Deploy Tailscale Operator for secure VPN access to internal services
- Add CNPG/PostgreSQL monitoring dashboards
- Add vLLM inference monitoring dashboards (tokens, latency, GPU)
- Add Cilium networking dashboards (policy, traffic, drops)
- Update infra-controllers staging kustomization to include all controllers
- Add monitoring-configs Flux sync for dashboard deployment
- Update README with monitoring architecture and access instructions
- Remove broken stale monitoring files (Azure Key Vault refs, wrong domains)
Access: kubectl port-forward or Tailscale VPN (replace auth key before deploy)
2026-04-26 02:31:53 +00:00
