feat(tailscale): add tailscale (#3488)
* feat(tailscale): add tailscale * env * see logs without env * try something * render configmap and adjust script * perms * call it differently * mount tmp * in ram * disable temp * change pers path * sysmod cap * no messaeg * fsgrp 0 * puid0 * hostnet * service * priv? * use the included script * common * secret * try with sa and rbac * secretname * render sercet * excelent copy paster * set tskubesec * disable probes and remove portal * without sys_mod * empty space * add configmap * render * copy paste specialist * lowercase * hmm * different * again * and try again * again * uhm * quote? * wth * enc secret * enable tty * mm * remove configmap for now * reenable configmap * I'M STUPIDDDD * enable config map * conditionally add tun * conditionaly add caps aswell * update desc * now test unprevileged * rootless * try nonuser-space + rootless * add docs and remove env (its defined in configmap already) * Update charts/incubator/tailscale/values.yaml * Update charts/incubator/tailscale/values.yaml * Update charts/incubator/tailscale/templates/_configmap.tpl * add sock5 and descriptions
This commit is contained in:
Stavros Kois
@@ -0,0 +1,30 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
# OWNERS file for Kubernetes
|
||||
OWNERS
|
||||
# helm-docs templates
|
||||
*.gotmpl
|
||||
# docs folder
|
||||
/docs
|
||||
# icon
|
||||
icon.png
|
||||
@@ -0,0 +1,27 @@
|
||||
apiVersion: v2
|
||||
appVersion: "10.6.2"
|
||||
dependencies:
|
||||
- name: common
|
||||
repository: https://library-charts.truecharts.org
|
||||
version: 10.4.12
|
||||
description: Tailscale lets you connect your devices and users together in your own secure virtual private network
|
||||
home: https://truecharts.org/docs/charts/stable/airsonic
|
||||
icon: https://truecharts.org/img/hotlink-ok/chart-icons/airsonic.png
|
||||
keywords:
|
||||
- vpn
|
||||
- tailscale
|
||||
kubeVersion: ">=1.16.0-0"
|
||||
maintainers:
|
||||
- email: info@truecharts.org
|
||||
name: TrueCharts
|
||||
url: https://truecharts.org
|
||||
name: tailscale
|
||||
sources:
|
||||
- https://hub.docker.com/r/tailscale/tailscale
|
||||
- https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh
|
||||
version: 0.0.1
|
||||
annotations:
|
||||
truecharts.org/catagories: |
|
||||
- network
|
||||
truecharts.org/SCALE-support: "true"
|
||||
truecharts.org/grade: U
|
||||
@@ -0,0 +1,19 @@
|
||||
# Installation Notes
|
||||
|
||||
If you want to use `Tailscale` in **non**-user mode, you have to run this as `root` user.
|
||||
You can do this by editing the following
|
||||
|
||||
Under `Tailscale Configuration`
|
||||
|
||||
- Uncheck `Userspace`
|
||||
|
||||
Under `Security and Permissions`
|
||||
|
||||
- Check `Show Advanced Security Settings`
|
||||
- Uncheck `ReadOnly Root Filesystem`
|
||||
- Uncheck `runAsNonRoot`
|
||||
|
||||
Under `Pod Security Context`
|
||||
|
||||
- runAsUser: `0`
|
||||
- runAsGroup: `0`
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 2.8 KiB |
@@ -0,0 +1,164 @@
|
||||
# Include{groups}
|
||||
portals: {}
|
||||
questions:
|
||||
# Include{global}
|
||||
# Include{controller}
|
||||
# Include{controllerDeployment}
|
||||
# Include{replicas}
|
||||
# Include{replica1}
|
||||
# Include{strategy}
|
||||
# Include{recreate}
|
||||
# Include{controllerExpert}
|
||||
# Include{controllerExpertExtraArgs}
|
||||
- variable: tailscale
|
||||
group: "Container Configuration"
|
||||
label: "Tailscale Configuration"
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: authkey
|
||||
label: "Auth Key"
|
||||
description: "Provide an auth key to automatically authenticate the node as your user account."
|
||||
schema:
|
||||
type: string
|
||||
private: true
|
||||
default: ""
|
||||
- variable: userspace
|
||||
label: "Userspace"
|
||||
description: "Userspace Networking mode allows running Tailscale where you don't have access to create a VPN tunnel device."
|
||||
schema:
|
||||
type: boolean
|
||||
default: true
|
||||
- variable: accept_dns
|
||||
label: "Accept DNS"
|
||||
description: "Accept DNS configuration from the admin console."
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: routes
|
||||
label: "Routes"
|
||||
description: Expose physical subnet routes to your entire Tailscale network.
|
||||
schema:
|
||||
type: string
|
||||
default: ""
|
||||
- variable: dest_ip
|
||||
label: "Dest IP"
|
||||
description: Tells the DNAT mechanism which Destination IP to set in the IP header, and where to send packets that are matched.
|
||||
schema:
|
||||
type: string
|
||||
default: ""
|
||||
- variable: sock5_server
|
||||
label: "Sock5 Server"
|
||||
schema:
|
||||
type: string
|
||||
default: ""
|
||||
- variable: extra_args
|
||||
label: "Extra Args"
|
||||
schema:
|
||||
type: string
|
||||
default: ""
|
||||
# Include{containerConfig}
|
||||
# Include{serviceRoot}
|
||||
- variable: main
|
||||
label: "Main Service"
|
||||
description: "The Primary service on which the healthcheck runs, often the webUI"
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{serviceSelector}
|
||||
- variable: main
|
||||
label: "Main Service Port Configuration"
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: port
|
||||
label: "Port"
|
||||
description: "This port exposes the container port on the service"
|
||||
schema:
|
||||
type: int
|
||||
default: 41641
|
||||
required: true
|
||||
# Include{advancedPortUDP}
|
||||
- variable: targetPort
|
||||
label: "Target Port"
|
||||
description: "The internal(!) port on the container the Application runs on"
|
||||
schema:
|
||||
type: int
|
||||
default: 41641
|
||||
# Include{serviceExpertRoot}
|
||||
default: false
|
||||
# Include{serviceExpert}
|
||||
# Include{serviceList}
|
||||
# Include{persistenceRoot}
|
||||
- variable: config
|
||||
label: "App Config Storage"
|
||||
description: "Stores the Application Configuration."
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{persistenceBasic}
|
||||
# Include{persistenceAdvanced}
|
||||
# Include{persistenceList}
|
||||
# Include{ingressRoot}
|
||||
- variable: main
|
||||
label: "Main Ingress"
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{ingressDefault}
|
||||
# Include{ingressTLS}
|
||||
# Include{ingressTraefik}
|
||||
# Include{ingressExpert}
|
||||
# Include{ingressList}
|
||||
# Include{security}
|
||||
# Include{securityContextAdvancedRoot}
|
||||
- variable: privileged
|
||||
label: "Privileged mode"
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: readOnlyRootFilesystem
|
||||
label: "ReadOnly Root Filesystem"
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: allowPrivilegeEscalation
|
||||
label: "Allow Privilege Escalation"
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: runAsNonRoot
|
||||
label: "runAsNonRoot"
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
# Include{securityContextAdvanced}
|
||||
# Include{podSecurityContextRoot}
|
||||
- variable: runAsUser
|
||||
label: "runAsUser"
|
||||
description: "The UserID of the user running the application"
|
||||
schema:
|
||||
type: int
|
||||
default: 0
|
||||
- variable: runAsGroup
|
||||
label: "runAsGroup"
|
||||
description: "The groupID this App of the user running the application"
|
||||
schema:
|
||||
type: int
|
||||
default: 0
|
||||
- variable: fsGroup
|
||||
label: "fsGroup"
|
||||
description: "The group that should own ALL storage."
|
||||
schema:
|
||||
type: int
|
||||
default: 568
|
||||
# Include{podSecurityContextAdvanced}
|
||||
# Include{resources}
|
||||
# Include{advanced}
|
||||
# Include{addons}
|
||||
# Include{documentation}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{/* Define the secret */}}
|
||||
{{- define "tailscale.config" -}}
|
||||
|
||||
{{- $configName := printf "%s-tailscale-config" (include "tc.common.names.fullname" .) }}
|
||||
{{- $secretName := printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ $configName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
TS_KUBE_SECRET: {{ $secretName | squote }}
|
||||
TS_USERSPACE: {{ .Values.tailscale.userspace | quote }}
|
||||
TS_ACCEPT_DNS: {{ .Values.tailscale.accept_dns | quote }}
|
||||
{{- with .Values.tailscale.routes }}
|
||||
TS_ROUTES: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.tailscale.dest_ip }}
|
||||
TS_DEST_IP: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.tailscale.sock5_server }}
|
||||
TS_SOCK5_SERVER: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.tailscale.extra_args }}
|
||||
TS_EXTRA_ARGS: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- define "tailscale.tun" -}}
|
||||
---
|
||||
enabled: true
|
||||
type: hostPath
|
||||
hostPath: /dev/net/tun
|
||||
mountPath: /dev/net/tun
|
||||
hostPathType: ""
|
||||
readOnly: false
|
||||
{{- end }}
|
||||
|
||||
{{- define "tailscale.caps" -}}
|
||||
---
|
||||
add:
|
||||
- NET_ADMIN
|
||||
{{- end }}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{/* Define the secret */}}
|
||||
{{- define "tailscale.secret" -}}
|
||||
|
||||
{{- $secretName := printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}
|
||||
|
||||
---
|
||||
{{/* This secrets are loaded on tailscale */}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
type: Opaque
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{- with .Values.tailscale.authkey }}
|
||||
TS_AUTH_KEY: {{ . | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{/* Make sure all variables are set properly */}}
|
||||
{{- include "tc.common.loader.init" . }}
|
||||
|
||||
{{/* Render secret */}}
|
||||
{{- include "tailscale.secret" . }}
|
||||
|
||||
{{/* Render config */}}
|
||||
{{- include "tailscale.config" . }}
|
||||
|
||||
{{- if not .Values.tailscale.userspace }}
|
||||
{{- $_ := set .Values.persistence "tun" (include "tailscale.tun" . | fromYaml) -}}
|
||||
{{- $_ := set .Values.securityContext "capabilities" (include "tailscale.caps" . | fromYaml) -}}
|
||||
{{- end }}
|
||||
|
||||
{{/* Render the templates */}}
|
||||
{{ include "tc.common.loader.apply" . }}
|
||||
@@ -0,0 +1,77 @@
|
||||
image:
|
||||
repository: tccr.io/truecharts/tailscale
|
||||
pullPolicy: IfNotPresent
|
||||
tag: v1.29.125@sha256:fb2ad07557c351805a126d0056be083fb67e3b22abae12a18c52f1461b55ca55
|
||||
|
||||
command: ["ash", "/tailscale/run.sh"]
|
||||
|
||||
tty: true
|
||||
|
||||
# Only un-comment this if you are going to have `userspace: false`
|
||||
# securityContext:
|
||||
# readOnlyRootFilesystem: false
|
||||
# runAsNonRoot: false
|
||||
|
||||
# podSecurityContext:
|
||||
# runAsUser: 0
|
||||
# runAsGroup: 0
|
||||
|
||||
serviceAccount:
|
||||
main:
|
||||
create: true
|
||||
|
||||
rbac:
|
||||
main:
|
||||
enabled: true
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "secrets"
|
||||
verbs:
|
||||
- "create"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "secrets"
|
||||
resourceNames:
|
||||
- '{{ printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}'
|
||||
verbs:
|
||||
- "get"
|
||||
- "update"
|
||||
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-tailscale-config'
|
||||
|
||||
tailscale:
|
||||
authkey: "supersecret"
|
||||
userspace: true
|
||||
accept_dns: false
|
||||
routes: ""
|
||||
dest_ip: ""
|
||||
sock5_server: ""
|
||||
extra_args: ""
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
main:
|
||||
protocol: UDP
|
||||
port: 41641
|
||||
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
mountPath: "/var/lib"
|
||||
|
||||
portal:
|
||||
enabled: false
|
||||
@@ -5,6 +5,7 @@ words:
|
||||
- APITOKEN
|
||||
- appname
|
||||
- Authentik
|
||||
- authkey
|
||||
- autoconnect
|
||||
- backupname
|
||||
- bazarr
|
||||
@@ -20,6 +21,7 @@ words:
|
||||
- dbengine
|
||||
- ddns
|
||||
- Djava
|
||||
- DNAT
|
||||
- dockerized
|
||||
- duplicati
|
||||
- dynmap
|
||||
@@ -112,6 +114,7 @@ words:
|
||||
- subquestions
|
||||
- svcname
|
||||
- syncthing
|
||||
- tailscale
|
||||
- targetport
|
||||
- tccr
|
||||
- teamspeak
|
||||
@@ -120,6 +123,7 @@ words:
|
||||
- truenas
|
||||
- truetool
|
||||
- unifi
|
||||
- userspace
|
||||
- valheim
|
||||
- vaultwarden
|
||||
- vdev
|
||||
|
||||
Reference in New Issue
Block a user