diff --git a/charts/incubator/tailscale/.helmignore b/charts/incubator/tailscale/.helmignore new file mode 100644 index 00000000000..77ca5567b26 --- /dev/null +++ b/charts/incubator/tailscale/.helmignore @@ -0,0 +1,30 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# OWNERS file for Kubernetes +OWNERS +# helm-docs templates +*.gotmpl +# docs folder +/docs +# icon +icon.png diff --git a/charts/incubator/tailscale/Chart.yaml b/charts/incubator/tailscale/Chart.yaml new file mode 100644 index 00000000000..60400b6a7e8 --- /dev/null +++ b/charts/incubator/tailscale/Chart.yaml @@ -0,0 +1,27 @@ +apiVersion: v2 +appVersion: "10.6.2" +dependencies: + - name: common + repository: https://library-charts.truecharts.org + version: 10.4.12 +description: Tailscale lets you connect your devices and users together in your own secure virtual private network +home: https://truecharts.org/docs/charts/stable/airsonic +icon: https://truecharts.org/img/hotlink-ok/chart-icons/airsonic.png +keywords: + - vpn + - tailscale +kubeVersion: ">=1.16.0-0" +maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org +name: tailscale +sources: + - https://hub.docker.com/r/tailscale/tailscale + - https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh +version: 0.0.1 +annotations: + truecharts.org/catagories: | + - network + truecharts.org/SCALE-support: "true" + truecharts.org/grade: U diff --git a/charts/incubator/tailscale/README.md b/charts/incubator/tailscale/README.md new file mode 100644 index 00000000000..e69de29bb2d diff --git a/charts/incubator/tailscale/docs/installation_notes.md b/charts/incubator/tailscale/docs/installation_notes.md new file mode 100644 index 00000000000..a708173f778 --- /dev/null +++ b/charts/incubator/tailscale/docs/installation_notes.md @@ -0,0 +1,19 @@ +# Installation Notes + +If you want to use `Tailscale` in **non**-user mode, you have to run this as `root` user. +You can do this by editing the following + +Under `Tailscale Configuration` + +- Uncheck `Userspace` + +Under `Security and Permissions` + +- Check `Show Advanced Security Settings` + - Uncheck `ReadOnly Root Filesystem` + - Uncheck `runAsNonRoot` + +Under `Pod Security Context` + +- runAsUser: `0` +- runAsGroup: `0` diff --git a/charts/incubator/tailscale/icon.png b/charts/incubator/tailscale/icon.png new file mode 100644 index 00000000000..4394182a645 Binary files /dev/null and b/charts/incubator/tailscale/icon.png differ diff --git a/charts/incubator/tailscale/questions.yaml b/charts/incubator/tailscale/questions.yaml new file mode 100644 index 00000000000..a848512b87e --- /dev/null +++ b/charts/incubator/tailscale/questions.yaml @@ -0,0 +1,164 @@ +# Include{groups} +portals: {} +questions: +# Include{global} +# Include{controller} +# Include{controllerDeployment} +# Include{replicas} +# Include{replica1} +# Include{strategy} +# Include{recreate} +# Include{controllerExpert} +# Include{controllerExpertExtraArgs} + - variable: tailscale + group: "Container Configuration" + label: "Tailscale Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: authkey + label: "Auth Key" + description: "Provide an auth key to automatically authenticate the node as your user account." + schema: + type: string + private: true + default: "" + - variable: userspace + label: "Userspace" + description: "Userspace Networking mode allows running Tailscale where you don't have access to create a VPN tunnel device." + schema: + type: boolean + default: true + - variable: accept_dns + label: "Accept DNS" + description: "Accept DNS configuration from the admin console." + schema: + type: boolean + default: false + - variable: routes + label: "Routes" + description: Expose physical subnet routes to your entire Tailscale network. + schema: + type: string + default: "" + - variable: dest_ip + label: "Dest IP" + description: Tells the DNAT mechanism which Destination IP to set in the IP header, and where to send packets that are matched. + schema: + type: string + default: "" + - variable: sock5_server + label: "Sock5 Server" + schema: + type: string + default: "" + - variable: extra_args + label: "Extra Args" + schema: + type: string + default: "" +# Include{containerConfig} +# Include{serviceRoot} + - variable: main + label: "Main Service" + description: "The Primary service on which the healthcheck runs, often the webUI" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: main + label: "Main Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 41641 + required: true +# Include{advancedPortUDP} + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 41641 +# Include{serviceExpertRoot} + default: false +# Include{serviceExpert} +# Include{serviceList} +# Include{persistenceRoot} + - variable: config + label: "App Config Storage" + description: "Stores the Application Configuration." + schema: + additional_attrs: true + type: dict + attrs: +# Include{persistenceBasic} +# Include{persistenceAdvanced} +# Include{persistenceList} +# Include{ingressRoot} + - variable: main + label: "Main Ingress" + schema: + additional_attrs: true + type: dict + attrs: +# Include{ingressDefault} +# Include{ingressTLS} +# Include{ingressTraefik} +# Include{ingressExpert} +# Include{ingressList} +# Include{security} +# Include{securityContextAdvancedRoot} + - variable: privileged + label: "Privileged mode" + schema: + type: boolean + default: false + - variable: readOnlyRootFilesystem + label: "ReadOnly Root Filesystem" + schema: + type: boolean + default: false + - variable: allowPrivilegeEscalation + label: "Allow Privilege Escalation" + schema: + type: boolean + default: false + - variable: runAsNonRoot + label: "runAsNonRoot" + schema: + type: boolean + default: false +# Include{securityContextAdvanced} +# Include{podSecurityContextRoot} + - variable: runAsUser + label: "runAsUser" + description: "The UserID of the user running the application" + schema: + type: int + default: 0 + - variable: runAsGroup + label: "runAsGroup" + description: "The groupID this App of the user running the application" + schema: + type: int + default: 0 + - variable: fsGroup + label: "fsGroup" + description: "The group that should own ALL storage." + schema: + type: int + default: 568 +# Include{podSecurityContextAdvanced} +# Include{resources} +# Include{advanced} +# Include{addons} +# Include{documentation} diff --git a/charts/incubator/tailscale/templates/_configmap.tpl b/charts/incubator/tailscale/templates/_configmap.tpl new file mode 100644 index 00000000000..e7e1d45acbc --- /dev/null +++ b/charts/incubator/tailscale/templates/_configmap.tpl @@ -0,0 +1,30 @@ +{{/* Define the secret */}} +{{- define "tailscale.config" -}} + +{{- $configName := printf "%s-tailscale-config" (include "tc.common.names.fullname" .) }} +{{- $secretName := printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }} + +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ $configName }} + labels: + {{- include "tc.common.labels" . | nindent 4 }} +data: + TS_KUBE_SECRET: {{ $secretName | squote }} + TS_USERSPACE: {{ .Values.tailscale.userspace | quote }} + TS_ACCEPT_DNS: {{ .Values.tailscale.accept_dns | quote }} + {{- with .Values.tailscale.routes }} + TS_ROUTES: {{ . }} + {{- end }} + {{- with .Values.tailscale.dest_ip }} + TS_DEST_IP: {{ . }} + {{- end }} + {{- with .Values.tailscale.sock5_server }} + TS_SOCK5_SERVER: {{ . }} + {{- end }} + {{- with .Values.tailscale.extra_args }} + TS_EXTRA_ARGS: {{ . | quote }} + {{- end }} +{{- end }} diff --git a/charts/incubator/tailscale/templates/_privelegednet.tpl b/charts/incubator/tailscale/templates/_privelegednet.tpl new file mode 100644 index 00000000000..72f14e48f7e --- /dev/null +++ b/charts/incubator/tailscale/templates/_privelegednet.tpl @@ -0,0 +1,15 @@ +{{- define "tailscale.tun" -}} +--- +enabled: true +type: hostPath +hostPath: /dev/net/tun +mountPath: /dev/net/tun +hostPathType: "" +readOnly: false +{{- end }} + +{{- define "tailscale.caps" -}} +--- +add: + - NET_ADMIN +{{- end }} diff --git a/charts/incubator/tailscale/templates/_secret.tpl b/charts/incubator/tailscale/templates/_secret.tpl new file mode 100644 index 00000000000..73c68d0b2c6 --- /dev/null +++ b/charts/incubator/tailscale/templates/_secret.tpl @@ -0,0 +1,19 @@ +{{/* Define the secret */}} +{{- define "tailscale.secret" -}} + +{{- $secretName := printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }} + +--- +{{/* This secrets are loaded on tailscale */}} +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: {{ $secretName }} + labels: + {{- include "tc.common.labels" . | nindent 4 }} +data: + {{- with .Values.tailscale.authkey }} + TS_AUTH_KEY: {{ . | b64enc }} + {{- end }} +{{- end }} diff --git a/charts/incubator/tailscale/templates/common.yaml b/charts/incubator/tailscale/templates/common.yaml new file mode 100644 index 00000000000..0e3f9e2f8cc --- /dev/null +++ b/charts/incubator/tailscale/templates/common.yaml @@ -0,0 +1,16 @@ +{{/* Make sure all variables are set properly */}} +{{- include "tc.common.loader.init" . }} + +{{/* Render secret */}} +{{- include "tailscale.secret" . }} + +{{/* Render config */}} +{{- include "tailscale.config" . }} + +{{- if not .Values.tailscale.userspace }} +{{- $_ := set .Values.persistence "tun" (include "tailscale.tun" . | fromYaml) -}} +{{- $_ := set .Values.securityContext "capabilities" (include "tailscale.caps" . | fromYaml) -}} +{{- end }} + +{{/* Render the templates */}} +{{ include "tc.common.loader.apply" . }} diff --git a/charts/incubator/tailscale/values.yaml b/charts/incubator/tailscale/values.yaml new file mode 100644 index 00000000000..2a828c2f703 --- /dev/null +++ b/charts/incubator/tailscale/values.yaml @@ -0,0 +1,77 @@ +image: + repository: tccr.io/truecharts/tailscale + pullPolicy: IfNotPresent + tag: v1.29.125@sha256:fb2ad07557c351805a126d0056be083fb67e3b22abae12a18c52f1461b55ca55 + +command: ["ash", "/tailscale/run.sh"] + +tty: true + +# Only un-comment this if you are going to have `userspace: false` +# securityContext: +# readOnlyRootFilesystem: false +# runAsNonRoot: false + +# podSecurityContext: +# runAsUser: 0 +# runAsGroup: 0 + +serviceAccount: + main: + create: true + +rbac: + main: + enabled: true + rules: + - apiGroups: + - "" + resources: + - "secrets" + verbs: + - "create" + - apiGroups: + - "" + resources: + - "secrets" + resourceNames: + - '{{ printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}' + verbs: + - "get" + - "update" + +envFrom: + - configMapRef: + name: '{{ include "tc.common.names.fullname" . }}-tailscale-config' + +tailscale: + authkey: "supersecret" + userspace: true + accept_dns: false + routes: "" + dest_ip: "" + sock5_server: "" + extra_args: "" + +probes: + liveness: + enabled: false + readiness: + enabled: false + startup: + enabled: false + +service: + main: + ports: + main: + protocol: UDP + port: 41641 + +persistence: + config: + enabled: true + mountPath: "/var/lib" + +portal: + enabled: false diff --git a/cspell.config.yaml b/cspell.config.yaml index 2af4e533b38..88e7c6480e9 100644 --- a/cspell.config.yaml +++ b/cspell.config.yaml @@ -5,6 +5,7 @@ words: - APITOKEN - appname - Authentik + - authkey - autoconnect - backupname - bazarr @@ -20,6 +21,7 @@ words: - dbengine - ddns - Djava + - DNAT - dockerized - duplicati - dynmap @@ -112,6 +114,7 @@ words: - subquestions - svcname - syncthing + - tailscale - targetport - tccr - teamspeak @@ -120,6 +123,7 @@ words: - truenas - truetool - unifi + - userspace - valheim - vaultwarden - vdev