feat(Tailscale): Move to stable and add How-To Guide (#3556)

* feat(Tailscale): Move to stable and add How-To Guide * linting error * trying something to fix pre-commit * update md * pre-commit fix Co-authored-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com> Co-authored-by: Stavros kois <s.kois@outlook.com>
2022-08-24 10:31:34 +03:00
parent a1fa0a5bbe
commit 1447649093
15 changed files with 57 additions and 1 deletions
@@ -0,0 +1,30 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# OWNERS file for Kubernetes
+OWNERS
+# helm-docs templates
+*.gotmpl
+# docs folder
+/docs
+# icon
+icon.png
@@ -0,0 +1,73 @@
+# Changelog
+
+
+
+## [tailscale-0.0.9](https://github.com/truecharts/charts/compare/tailscale-0.0.8...tailscale-0.0.9) (2022-08-23)
+
+### Chore
+
+- update helm general non-major helm releases ([#3545](https://github.com/truecharts/charts/issues/3545))
+
+
+
+
+## [tailscale-0.0.8](https://github.com/truecharts/charts/compare/tailscale-0.0.7...tailscale-0.0.8) (2022-08-22)
+
+### Fix
+
+- use different ports for targetPort and port ([#3539](https://github.com/truecharts/charts/issues/3539))
+
+
+
+
+## [tailscale-0.0.7](https://github.com/truecharts/charts/compare/tailscale-0.0.5...tailscale-0.0.7) (2022-08-22)
+
+### Fix
+
+- use role and rolebind instead of clusterrole ([#3537](https://github.com/truecharts/charts/issues/3537))
+
+
+
+
+## [tailscale-0.0.5](https://github.com/truecharts/charts/compare/tailscale-0.0.4...tailscale-0.0.5) (2022-08-22)
+
+### Fix
+
+- don't override varrun ([#3532](https://github.com/truecharts/charts/issues/3532))
+
+
+
+
+## [tailscale-0.0.4](https://github.com/truecharts/charts/compare/tailscale-0.0.3...tailscale-0.0.4) (2022-08-20)
+
+### Fix
+
+- adds tun device and runs as root by default ([#3519](https://github.com/truecharts/charts/issues/3519))
+
+
+
+
+## [tailscale-0.0.3](https://github.com/truecharts/charts/compare/tailscale-0.0.2...tailscale-0.0.3) (2022-08-18)
+
+### Chore
+
+- update temporary to upstream image repo ([#3511](https://github.com/truecharts/charts/issues/3511))
+
+
+
+
+## [tailscale-0.0.2](https://github.com/truecharts/charts/compare/tailscale-0.0.1...tailscale-0.0.2) (2022-08-18)
+
+### Chore
+
+- Auto-update chart README [skip ci]
+  - default to rootless ([#3509](https://github.com/truecharts/charts/issues/3509))
+
+
+
+
+## [tailscale-0.0.1]tailscale-0.0.1 (2022-08-17)
+
+### Feat
+
+- add tailscale ([#3488](https://github.com/truecharts/charts/issues/3488))
@@ -0,0 +1,28 @@
+apiVersion: v2
+appVersion: "1.29.125"
+dependencies:
+  - name: common
+    repository: https://library-charts.truecharts.org
+    version: 10.5.0
+description: Tailscale lets you connect your devices and users together in your own secure virtual private network
+home: https://truecharts.org/docs/charts/incubator/tailscale
+icon: https://truecharts.org/img/hotlink-ok/chart-icons/tailscale.png
+keywords:
+  - vpn
+  - tailscale
+kubeVersion: ">=1.16.0-0"
+maintainers:
+  - email: info@truecharts.org
+    name: TrueCharts
+    url: https://truecharts.org
+name: tailscale
+sources:
+  - https://github.com/truecharts/charts/tree/master/charts/incubator/tailscale
+  - https://hub.docker.com/r/tailscale/tailscale
+  - https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh
+version: 1.0.0
+annotations:
+  truecharts.org/catagories: |
+    - network
+  truecharts.org/SCALE-support: "true"
+  truecharts.org/grade: U
@@ -0,0 +1,109 @@
+# tailscale
+
+![Version: 0.0.9](https://img.shields.io/badge/Version-0.0.9-informational?style=flat-square) ![AppVersion: 1.29.125](https://img.shields.io/badge/AppVersion-1.29.125-informational?style=flat-square)
+
+Tailscale lets you connect your devices and users together in your own secure virtual private network
+
+TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
+
+This readme is just an automatically generated general guide on installing our Helm Charts and Apps.
+For more information, please click here: [tailscale](https://truecharts.org/docs/charts/incubator/tailscale)
+
+**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
+
+## Source Code
+
+* <https://github.com/truecharts/charts/tree/master/charts/incubator/tailscale>
+* <https://hub.docker.com/r/tailscale/tailscale>
+* <https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh>
+
+## Requirements
+
+Kubernetes: `>=1.16.0-0`
+
+## Dependencies
+
+| Repository | Name | Version |
+|------------|------|---------|
+| https://library-charts.truecharts.org | common | 10.5.0 |
+
+## Installing the Chart
+
+### TrueNAS SCALE
+
+To install this Chart on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/docs/manual/SCALE%20Apps/Quick-Start%20Guides/Installing-an-App).
+
+### Helm
+
+To install the chart with the release name `tailscale`
+
+```console
+helm repo add TrueCharts https://charts.truecharts.org
+helm repo update
+helm install tailscale TrueCharts/tailscale
+```
+
+## Uninstall
+
+### TrueNAS SCALE
+
+**Upgrading, Rolling Back and Uninstalling the Chart**
+
+To upgrade, rollback or delete this Chart from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/docs/manual/SCALE%20Apps/Quick-Start%20Guides/Upgrade-rollback-delete-an-App).
+
+### Helm
+
+To uninstall the `tailscale` deployment
+
+```console
+helm uninstall tailscale
+```
+
+## Configuration
+
+### Helm
+
+#### Available Settings
+
+Read through the [values.yaml](./values.yaml) file. It has several commented out suggested values.
+Other values may be used from the [values.yaml](https://github.com/truecharts/library-charts/tree/main/charts/stable/common/values.yaml) from the [common library](https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common).
+
+#### Configure using the command line
+
+Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
+
+```console
+helm install tailscale \
+  --set env.TZ="America/New York" \
+    TrueCharts/tailscale
+```
+
+#### Configure using a yaml file
+
+Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart.
+
+```console
+helm install tailscale TrueCharts/tailscale -f values.yaml
+```
+
+#### Connecting to other charts
+
+If you need to connect this Chart to other Charts on TrueNAS SCALE, please refer to our [Linking Charts Internally](https://truecharts.org/docs/manual/SCALE%20Apps/Quick-Start%20Guides/linking-apps) quick-start guide.
+
+## Support
+
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/docs/manual/SCALE%20Apps/Quick-Start%20Guides/Important-MUST-READ).
+- See the [Website](https://truecharts.org)
+- Check our [Discord](https://discord.gg/tVsPTHWTtr)
+- Open a [issue](https://github.com/truecharts/apps/issues/new/choose)
+
+---
+
+## Sponsor TrueCharts
+
+TrueCharts can only exist due to the incredible effort of our staff.
+Please consider making a [donation](https://truecharts.org/docs/about/sponsor) or contributing back to the project any way you can!
+
+---
+
+All Rights Reserved - The TrueCharts Project
@@ -0,0 +1,55 @@
+# How-To
+
+This is a quick how-to or setup-guide to use Tailscale using on your TrueNAS box.
+This can be applied to other systems but this specific guide is SCALE specific with the prerequisites.
+
+## Requirements
+
+- Tailscale Account (Free accounts available at https://www.tailscale.com)
+- Tailscale Truecharts Chart
+
+## Prerequisites
+
+For proper access to your local network (LAN), this chart requires two `sysctl` values set on your TrueNAS or system. For TrueNAS SCALE the way to change these values are inside `System` then `Advanced`. On that screen you add the following two values:
+
+- `net.ipv4.ip_forward`
+- `net.ipv4.conf.all.src_valid_mark`
+
+Set them to `1` and `Enabled`
+
+![sysctl](img/Sysctl.png)
+
+Also prepare your Tailscale Auth Key for your setup, easy to generate on the page below
+
+![tailscale-auth-key](img/How-To-Image-1.png)
+
+## Tailscale Chart Setup
+
+Step 1-2: Ideally use `tailscale` but you can use any name here and leave defaults for Step 2
+
+Step 3:
+
+- Enter `Auth Key` you received from tailscale in prerequistes above
+- Keep `Userspace` checked (default) unless you wish to create your own Wireguard tunnels,
+- The default for `Accept DNS` is unchecked but enabling it will pass your Global Nameservers from Tailscale to your local install
+- Change `Routes` to the routes you wish Tailscale to have access to on the devices it's connected, such as my LAN in the example
+- `Extra Args` passes arguments/flags to the `tailscale up` command. The most common one is `--advertise-exit-node` to pass traffic through tailscale like a private VPN. For more Extra Args please check the [Tailscale Knowledge Base](https://tailscale.com/kb/1080/cli/#up)
+
+![tailscale-step-3](img/How-To-Image-2.png)
+
+Step 4:
+
+- The default ports are fine for this chart, you shouldn't need to port forward or open ports on your router. However many people will want to access their SMB shares or TrueNAS GUI via Tailscale. In order to do so you will have to ensure the screen is setup as below.
+
+![tailscale-step-4](img/How-To-Image-3.png)
+
+Steps 5-9: Adjust as necessary but defaults are fine.
+
+## Support
+
+- You can also reach us using [Discord](https://discord.gg/tVsPTHWTtr) for real-time feedback and support
+- If you found a bug in our chart, open a Github [issue](https://github.com/truecharts/apps/issues/new/choose)
+
+---
+
+All Rights Reserved - The TrueCharts Project
@@ -0,0 +1,170 @@
+# Include{groups}
+portals: {}
+questions:
+# Include{global}
+# Include{controller}
+# Include{controllerDeployment}
+# Include{replicas}
+# Include{replica1}
+# Include{strategy}
+# Include{recreate}
+# Include{controllerExpert}
+# Include{controllerExpertExtraArgs}
+  - variable: tailscale
+    group: "Container Configuration"
+    label: "Tailscale Configuration"
+    schema:
+      additional_attrs: true
+      type: dict
+      attrs:
+        - variable: authkey
+          label: "Auth Key"
+          description: "Provide an auth key to automatically authenticate the node as your user account."
+          schema:
+            type: string
+            private: true
+            default: ""
+        - variable: userspace
+          label: "Userspace"
+          description: "Userspace Networking mode allows running Tailscale where you don't have access to create a VPN tunnel device."
+          schema:
+            type: boolean
+            default: true
+        - variable: accept_dns
+          label: "Accept DNS"
+          description: "Accept DNS configuration from the admin console."
+          schema:
+            type: boolean
+            default: false
+        - variable: routes
+          label: "Routes"
+          description: Expose physical subnet routes to your entire Tailscale network.
+          schema:
+            type: string
+            default: ""
+        - variable: dest_ip
+          label: "Dest IP"
+          description: Tells the DNAT mechanism which Destination IP to set in the IP header, and where to send packets that are matched.
+          schema:
+            type: string
+            default: ""
+        - variable: sock5_server
+          label: "Sock5 Server"
+          schema:
+            type: string
+            default: ""
+        - variable: extra_args
+          label: "Extra Args"
+          description: UP_ARGS or flags to pass along to Tailscale, such as --advertise-exit-node
+          schema:
+            type: string
+            default: ""
+        - variable: daemon_extra_args
+          label: "Tailscale Daemon Extra Args"
+          schema:
+            type: string
+            default: ""
+# Include{containerConfig}
+# Include{serviceRoot}
+        - variable: main
+          label: "Main Service"
+          description: "The Primary service on which the healthcheck runs, often the webUI"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{serviceSelector}
+                    - variable: main
+                      label: "Main Service Port Configuration"
+                      schema:
+                        additional_attrs: true
+                        type: dict
+                        attrs:
+                          - variable: port
+                            label: "Port"
+                            description: "This port exposes the container port on the service"
+                            schema:
+                              type: int
+                              default: 41600
+                              required: true
+# Include{advancedPortUDP}
+                                - variable: targetPort
+                                  label: "Target Port"
+                                  description: "The internal(!) port on the container the Application runs on"
+                                  schema:
+                                    type: int
+                                    default: 41700
+# Include{serviceExpertRoot}
+            default: false
+# Include{serviceExpert}
+# Include{serviceList}
+# Include{persistenceRoot}
+        - variable: config
+          label: "App Config Storage"
+          description: "Stores the Application Configuration."
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{persistenceBasic}
+# Include{persistenceAdvanced}
+# Include{persistenceList}
+# Include{ingressRoot}
+        - variable: main
+          label: "Main Ingress"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{ingressDefault}
+# Include{ingressTLS}
+# Include{ingressTraefik}
+# Include{ingressExpert}
+# Include{ingressList}
+# Include{security}
+# Include{securityContextAdvancedRoot}
+              - variable: privileged
+                label: "Privileged mode"
+                schema:
+                  type: boolean
+                  default: false
+              - variable: readOnlyRootFilesystem
+                label: "ReadOnly Root Filesystem"
+                schema:
+                  type: boolean
+                  default: false
+              - variable: allowPrivilegeEscalation
+                label: "Allow Privilege Escalation"
+                schema:
+                  type: boolean
+                  default: false
+              - variable: runAsNonRoot
+                label: "runAsNonRoot"
+                schema:
+                  type: boolean
+                  default: false
+# Include{securityContextAdvanced}
+# Include{podSecurityContextRoot}
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: "The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+# Include{podSecurityContextAdvanced}
+# Include{resources}
+# Include{advanced}
+# Include{addons}
+# Include{documentation}
@@ -0,0 +1,33 @@
+{{/* Define the secret */}}
+{{- define "tailscale.config" -}}
+
+{{- $configName := printf "%s-tailscale-config" (include "tc.common.names.fullname" .) }}
+{{- $secretName := printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $configName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  TS_KUBE_SECRET: {{ $secretName | squote }}
+  TS_USERSPACE: {{ .Values.tailscale.userspace | quote }}
+  TS_ACCEPT_DNS: {{ .Values.tailscale.accept_dns | quote }}
+  {{- with .Values.tailscale.routes }}
+  TS_ROUTES: {{ . }}
+  {{- end }}
+  {{- with .Values.tailscale.dest_ip }}
+  TS_DEST_IP: {{ . }}
+  {{- end }}
+  {{- with .Values.tailscale.sock5_server }}
+  TS_SOCK5_SERVER: {{ . }}
+  {{- end }}
+  {{- with .Values.tailscale.extra_args }}
+  TS_EXTRA_ARGS: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.tailscale.daemon_extra_args }}
+  TS_TAILSCALED_EXTRA_ARGS: {{ . | quote }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,19 @@
+{{/* Define the secret */}}
+{{- define "tailscale.secret" -}}
+
+{{- $secretName := printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}
+
+---
+{{/* This secrets are loaded on tailscale */}}
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ $secretName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  {{- with .Values.tailscale.authkey }}
+  TS_AUTH_KEY: {{ . | b64enc }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,11 @@
+{{/* Make sure all variables are set properly */}}
+{{- include "tc.common.loader.init" . }}
+
+{{/* Render secret */}}
+{{- include "tailscale.secret" . }}
+
+{{/* Render config */}}
+{{- include "tailscale.config" . }}
+
+{{/* Render the templates */}}
+{{ include "tc.common.loader.apply" . }}
@@ -0,0 +1,91 @@
+image:
+  repository: tailscale/tailscale
+  pullPolicy: IfNotPresent
+  tag: v1.29.125@sha256:5bfeda9594bfbc8ad5f7fbb0fb4827ed8066bd07af0fc3435e44e0494552447c
+
+command: ["ash", "/tailscale/run.sh"]
+
+tty: true
+
+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+  capabilities:
+    add:
+      - NET_ADMIN
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
+serviceAccount:
+  main:
+    create: true
+
+rbac:
+  main:
+    enabled: true
+    rules:
+      - apiGroups:
+          - ""
+        resources:
+          - "secrets"
+        verbs:
+          - "create"
+      - apiGroups:
+          - ""
+        resources:
+          - "secrets"
+        resourceNames:
+          - '{{ printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}'
+        verbs:
+          - "get"
+          - "update"
+
+envFrom:
+  - secretRef:
+      name: '{{ include "tc.common.names.fullname" . }}-tailscale-secret'
+  - configMapRef:
+      name: '{{ include "tc.common.names.fullname" . }}-tailscale-config'
+
+tailscale:
+  authkey: "supersecret"
+  userspace: true
+  accept_dns: false
+  routes: ""
+  dest_ip: ""
+  sock5_server: ""
+  extra_args: ""
+  daemon_extra_args: ""
+
+probes:
+  liveness:
+    enabled: false
+  readiness:
+    enabled: false
+  startup:
+    enabled: false
+
+service:
+  main:
+    ports:
+      main:
+        protocol: UDP
+        port: 41700
+
+persistence:
+  varrun:
+    enabled: false
+  config:
+    enabled: true
+    mountPath: "/var/lib"
+  tun:
+    enabled: true
+    type: hostPath
+    hostPath: /dev/net/tun
+    mountPath: /dev/net/tun
+    hostPathType: ""
+    readOnly: false
+
+portal:
+  enabled: false