116ac9ca48
- Bump chart version 1.86.x -> 1.96.x - Migrate operator: -> operatorConfig: (new chart structure) - Disable OAuth/OIDC to use existing authkey secret - Add securityContext for restricted:latest PodSecurity policy - Add podSecurityContext.runAsNonRoot - Drop ALL capabilities, disable privilege escalation - Add RuntimeDefault seccomp profile
48 lines
1.1 KiB
YAML
48 lines
1.1 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: tailscale-operator
|
|
namespace: tailscale
|
|
spec:
|
|
interval: 1h
|
|
timeout: 15m
|
|
chart:
|
|
spec:
|
|
chart: tailscale-operator
|
|
version: "1.96.x"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: tailscale
|
|
namespace: tailscale
|
|
interval: 12h
|
|
targetNamespace: tailscale
|
|
install:
|
|
createNamespace: true
|
|
crds: Create
|
|
upgrade:
|
|
crds: CreateReplace
|
|
values:
|
|
# Operator configuration
|
|
operatorConfig:
|
|
# Tag to use for pods created by the operator (e.g., tailnet)
|
|
hostname: "tailscale-operator"
|
|
# Auth key via existing secret
|
|
useOAuth: false
|
|
useOIDC: false
|
|
# Concurrency
|
|
tailscaleOperator:
|
|
setConcurrentResourceReconciles: 2
|
|
# PodSecurity "restricted:latest" compliance
|
|
podSecurityContext:
|
|
runAsNonRoot: true
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
# Disable webhook (optional)
|
|
webhook:
|
|
enabled: false
|