From 32a47b60afff28d0c0d40fdc279144961f539cf4 Mon Sep 17 00:00:00 2001
From: Stavros Kois <47820033+stavros-k@users.noreply.github.com>
Date: Wed, 17 Aug 2022 22:55:10 +0300
Subject: [PATCH] feat(tailscale): add tailscale (#3488)

* feat(tailscale): add tailscale

* env

* see logs without env

* try something

* render configmap and adjust script

* perms

* call it differently

* mount tmp

* in ram

* disable temp

* change pers path

* sysmod cap

* no messaeg

* fsgrp 0

* puid0

* hostnet

* service

* priv?

* use the included script

* common

* secret

* try with sa and rbac

* secretname

* render sercet

* excelent copy paster

* set tskubesec

* disable probes and remove portal

* without sys_mod

* empty space

* add configmap

* render

* copy paste specialist

* lowercase

* hmm

* different

* again

* and try again

* again

* uhm

* quote?

* wth

* enc secret

* enable tty

* mm

* remove configmap for now

* reenable configmap

* I'M STUPIDDDD

* enable config map

* conditionally add tun

* conditionaly add caps aswell

* update desc

* now test unprevileged

* rootless

* try nonuser-space + rootless

* add docs and remove env (its defined in configmap already)

* Update charts/incubator/tailscale/values.yaml

* Update charts/incubator/tailscale/values.yaml

* Update charts/incubator/tailscale/templates/_configmap.tpl

* add sock5 and descriptions
---
 charts/incubator/tailscale/.helmignore        |  30 ++++
 charts/incubator/tailscale/Chart.yaml         |  27 +++
 charts/incubator/tailscale/README.md          |   0
 .../tailscale/docs/installation_notes.md      |  19 ++
 charts/incubator/tailscale/icon.png           | Bin 0 -> 2910 bytes
 charts/incubator/tailscale/questions.yaml     | 164 ++++++++++++++++++
 .../tailscale/templates/_configmap.tpl        |  30 ++++
 .../tailscale/templates/_privelegednet.tpl    |  15 ++
 .../incubator/tailscale/templates/_secret.tpl |  19 ++
 .../incubator/tailscale/templates/common.yaml |  16 ++
 charts/incubator/tailscale/values.yaml        |  77 ++++++++
 cspell.config.yaml                            |   4 +
 12 files changed, 401 insertions(+)
 create mode 100644 charts/incubator/tailscale/.helmignore
 create mode 100644 charts/incubator/tailscale/Chart.yaml
 create mode 100644 charts/incubator/tailscale/README.md
 create mode 100644 charts/incubator/tailscale/docs/installation_notes.md
 create mode 100644 charts/incubator/tailscale/icon.png
 create mode 100644 charts/incubator/tailscale/questions.yaml
 create mode 100644 charts/incubator/tailscale/templates/_configmap.tpl
 create mode 100644 charts/incubator/tailscale/templates/_privelegednet.tpl
 create mode 100644 charts/incubator/tailscale/templates/_secret.tpl
 create mode 100644 charts/incubator/tailscale/templates/common.yaml
 create mode 100644 charts/incubator/tailscale/values.yaml

diff --git a/charts/incubator/tailscale/.helmignore b/charts/incubator/tailscale/.helmignore
new file mode 100644
index 00000000000..77ca5567b26
--- /dev/null
+++ b/charts/incubator/tailscale/.helmignore
@@ -0,0 +1,30 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# OWNERS file for Kubernetes
+OWNERS
+# helm-docs templates
+*.gotmpl
+# docs folder
+/docs
+# icon
+icon.png
diff --git a/charts/incubator/tailscale/Chart.yaml b/charts/incubator/tailscale/Chart.yaml
new file mode 100644
index 00000000000..60400b6a7e8
--- /dev/null
+++ b/charts/incubator/tailscale/Chart.yaml
@@ -0,0 +1,27 @@
+apiVersion: v2
+appVersion: "10.6.2"
+dependencies:
+  - name: common
+    repository: https://library-charts.truecharts.org
+    version: 10.4.12
+description: Tailscale lets you connect your devices and users together in your own secure virtual private network
+home: https://truecharts.org/docs/charts/stable/airsonic
+icon: https://truecharts.org/img/hotlink-ok/chart-icons/airsonic.png
+keywords:
+  - vpn
+  - tailscale
+kubeVersion: ">=1.16.0-0"
+maintainers:
+  - email: info@truecharts.org
+    name: TrueCharts
+    url: https://truecharts.org
+name: tailscale
+sources:
+  - https://hub.docker.com/r/tailscale/tailscale
+  - https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh
+version: 0.0.1
+annotations:
+  truecharts.org/catagories: |
+    - network
+  truecharts.org/SCALE-support: "true"
+  truecharts.org/grade: U
diff --git a/charts/incubator/tailscale/README.md b/charts/incubator/tailscale/README.md
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/charts/incubator/tailscale/docs/installation_notes.md b/charts/incubator/tailscale/docs/installation_notes.md
new file mode 100644
index 00000000000..a708173f778
--- /dev/null
+++ b/charts/incubator/tailscale/docs/installation_notes.md
@@ -0,0 +1,19 @@
+# Installation Notes
+
+If you want to use `Tailscale` in **non**-user mode, you have to run this as `root` user.
+You can do this by editing the following
+
+Under `Tailscale Configuration`
+
+- Uncheck `Userspace`
+
+Under `Security and Permissions`
+
+- Check `Show Advanced Security Settings`
+  - Uncheck `ReadOnly Root Filesystem`
+  - Uncheck `runAsNonRoot`
+
+Under `Pod Security Context`
+
+- runAsUser: `0`
+- runAsGroup: `0`
diff --git a/charts/incubator/tailscale/icon.png b/charts/incubator/tailscale/icon.png
new file mode 100644
index 0000000000000000000000000000000000000000..4394182a645c4dea52c647f6715247203534b25d
GIT binary patch
literal 2910
zcmcImcU05K7XF125KwBU3kXP&Py_^Ik+8A|OEc0$2?;EbUW5n%0t7+Sx73xaMj;X<
zbd(sBNHJhpK~@0)F@%V8goIwDzu-G(*WLf#dFS1kGiT<`cklhCoVl~xw>tz#INCYb
z0U!_nfOrMiWdrHJKCqCKxP-XGpH)GE*OxjVE(MX4m4!$_q~(=$4$3QPDoI1sjMOv_
zLk$cJ6jV)YO^%uC=o>&mA|fJ!f`SKl6{;Yu0R69J_Zc853=9Lq{2+CJPZGp03EKS~
z_->D);2zaKMF7Mv2o~ZK=FM720DOEPkRX^JEGWSL6#?So7myT`QZqUM7IOVL`nq)L
zJsEXl8@H}B+VkOg4NP7U#KfOxD)Tp=UrqP4lHW%9kG3BW;|K8=@k;{M!0f@V%Kxd6
z2^YEiHju1Ero3O~IpWKn6g)9u0w=(`I5^%IWVgIC<e`E-x_)$9Ve;>hgjp=dI&KF%
zZ>Lm*TVj5{u(=JVZr58#uibF-bxElZ<1<EB2U~druE5g>6Ab5I{!l@Z#he#-y^e~R
zm%O;RqqsmAYpzIZV7YL$1{c@mR!J*#l(+rlNxq7yooM4kOP;mX3Nwx9Yv=z=>9jr?
zj+03Cao>>p;o4&pnBs5?Ja2v}P>LO3e!l=;GDES7AQO7nTj%|B3rSu=BUz>Goe||O
zT&kc!Q`Rep^ZsHLox)|bp?ukFuHUz7@mpnhpJQ}8Bvy-WNVpKSuAGnaZT8r5*58D^
zUjBqK+P?HJPeaUfbl|#;uW8wmalDdsbOk)CL9;C-N(=4PDBSv7bBTil#18aUVOusF
z!Zv?x&xI<SQ)VtEyB}ftos;_#N6d=f1~SeV^%mDR3HJH7&z~l?hittq1$Tbj>>f2d
zaDBT^I^^m!T2;7YI@b?$sXsQdZ%cEn8KXuUABAdAhBjaow-68Ya>sk)TXWwDze3CQ
zI~CyMe*OhLzAx!RCMO{32u$@8Q6X7fp#NT@JXL^LWA*JKd57C^%2_vOg>WU>Hy`7g
z+sHS6@aGv)*ryqbqX@$uWNq7~7My1R3WDlF>~U|@d{R8d<y!|*<0Yc#Emm`m7@gWL
zUg28X1noV)G~#U}6vyVFJPBEHjefoYdivDd#BNeX1RlcP*L=S1?jGzf3Ar<Y{bZ@3
za7?GuU}mz{r*^<QgmHd(i`E;(>9=p+yb$ht2i>SUHHc<r4GvsosHwQ3eqvj4I&QGh
z>f$%8Vq76z+TOLz1+|-sIx-(oqJ5l!zBqD(x#u-<*b~JzyE<PqhW<;Fq#M!VM3Z6@
z6otc#pGaNJ01G`#SZrezz_>~`2(QX;a8hv*fv^-2wq)`wM0pZB6`rr5_&(@1ez96=
zRAi*ikyTw0R)qAWz@qy%-KN>fEU#0WD$Tgo${dCUkCcN(;9MfiYlhVR`33n(E@W8#
zOz|!-W6^xOG}SgQq<Vj}OH^1p>>6^G`jm~1J!`RQ8CqM(eNE#=xF>1sYunLzQslDW
zQvE$<4Bhp3%M1K;g?~oC<9F<juyY7&A@!7;X>UEkLcs$I>tyFTMRDAnCWLOer``0U
zYD8DoO<F0#8`~B;lJ8Une@?cHKvJ;Coaus~<eJZxDoZG*Vz0a|B_Z6o#pdv!dMi(C
zrFye7G{f7laB2OKCkR4u^Es3s>Xc6K$xl{bS(eWkvydooGFi&ZRHR0G7pO5ws;u$7
z4ciC9&2yq_XoSpDh7Kny4jV-0;YyqQk_$6#&2|JGCmlcji@qk_%&I-!Qa3Aq<F>?K
zCk+5F?A##QF}t`XE~WczrFdf5s|S&e)(fXotThVANNm}o#}UUvM#i-3^$(ROLvFa>
zl@4y0uDDc}@y)2lu<d0rUrdwfcThLohVJ*2Zo7q)O;z&SSoL_6>AaA{kjCZhprkVG
zVz;FTivP=L@cRbDLl#T4<CS6&Bfu=@`M{G{8mlMgjK?U}AC5V~92(_3jxcX=@2X`y
zPl)A@pQgXrRFTz!;u?%N4{HB#&ypgbsO~xv{1daAbUhlqc&=+p@3l?eo5i^nUD+R*
zvn{?Y7nit^A6EUdE3);%)0dezGy9VPCQj)iJ2=x`vmC+x101u$L*w&Pn*rYQPn25|
zs5_N}PnpZT38@r0no&^fjUEr52lVJ_BcJiZR#F=UVDUJ%+q%xnpaJC+)5aS%u!wf*
zJyznA*%l>ZCvElUMsvHHoD?BtQ_4qXRtcpiVd`bx=kmx+p&&hHAD{CpXP4bit#Ll4
z<*aqOI1GW7%##`w&o-V}pWIRL&T&>%HVv_R%^fMO-8mHe`2(_Mx<tuKxeHGVnS0R}
zvT&Hp$ziB!HBc|6Ma*(m3-!kC<*qgmq0t{vRUP!Tq8*on)M6<!tk_~?l}hn=#0R_b
zl8xeJX4gf$LjhPQuHekNPAlIeXBSXrf2CelRun#?%w7vay-5jf2%Tox$0ZmpmuG%f
zTp3}HjqNx@zc)`NUi%KGQ>2=fUsaJpmvHs9brk;g&H%uYMfp+)jsdLP)&EglJdK1{
z3~t~d__VtEV@B=qo19YBO16gZW?L%Mrc^s<wLnx0@mt`?fOVJW$|+RaZ9g7ZMUQ5`
zaFpTwL*lz&@2j=}f4JhaLy>=v!>9G`&6numFJ#SaX9xj<Yol+S(+=%K1dQcvNCMKU
z_{2<C!Uw~vR8k5J0M+t!$gEXePFiz~-!IBQeM%XrxDpfj#%%ec%uQOQ=w-SSH4TYs
z5?k*K2|^IUt6$f|Aq=o**GeXz%H?$>D8Uo!yBotN<}f8pTd#Dq4~o3_8~JU|rQ#y8
zX+>{i)to_pWR>Xm%s|r`&lkKW>ef<{hMacG=?f=YGnj>>`qR6BsSoq6YOs2#60N?w
zjnyaD&JC!$wZwZOsx3PQ-HiqGDFyT0u3Hx-pE@5JWA`!;oOL2SeT9yP!y^Tvz)nFy
zdx;dDb|D`RK6=osSTu&0Nr_qh+g(xL?u?igv&vyECU2u!fIqP5#<9A#C_MM=%fUz5
za%=d-#n00MQZ(<!MDu6Y#Y9!d!kD&Mg$Fu4w<lJJ-LOlJtyHXJZrV?Efa<ZeQJQA%
z<MHbaJF?+w{>1Sw4>PX(y3&1wxPT+gZ*Xg^NR*IKCna_L=e3&0Chu2<{WdhHRf~5q
zt2eofz1E;i$u?h&*XxhPovOEyEurq;m|&`|a)e-pL&L1=5iy?1+(=SbdQyOP(RwWJ
zM#99g2=6JK`wAZ#I=H&&8WTIK)Ug6f)i@-pw`Q>4Aivr4Rco@o?mbhAXIbl+Ity4>
z(P(*OqIA%GpYZTt2Kpq#jhvA#6T2a81NdPdAn4}ZJ}DT5n)9Po8jXhd^52n<!ZU}S
z5HomNpwSzJ35D`9?{F%5D?5Q9Wn6bww@IICsFL|^pJ%HrG0mxO?<@6B0o?_T{!{mV
J8-sRP{{{(R&_@6O

literal 0
HcmV?d00001

diff --git a/charts/incubator/tailscale/questions.yaml b/charts/incubator/tailscale/questions.yaml
new file mode 100644
index 00000000000..a848512b87e
--- /dev/null
+++ b/charts/incubator/tailscale/questions.yaml
@@ -0,0 +1,164 @@
+# Include{groups}
+portals: {}
+questions:
+# Include{global}
+# Include{controller}
+# Include{controllerDeployment}
+# Include{replicas}
+# Include{replica1}
+# Include{strategy}
+# Include{recreate}
+# Include{controllerExpert}
+# Include{controllerExpertExtraArgs}
+  - variable: tailscale
+    group: "Container Configuration"
+    label: "Tailscale Configuration"
+    schema:
+      additional_attrs: true
+      type: dict
+      attrs:
+        - variable: authkey
+          label: "Auth Key"
+          description: "Provide an auth key to automatically authenticate the node as your user account."
+          schema:
+            type: string
+            private: true
+            default: ""
+        - variable: userspace
+          label: "Userspace"
+          description: "Userspace Networking mode allows running Tailscale where you don't have access to create a VPN tunnel device."
+          schema:
+            type: boolean
+            default: true
+        - variable: accept_dns
+          label: "Accept DNS"
+          description: "Accept DNS configuration from the admin console."
+          schema:
+            type: boolean
+            default: false
+        - variable: routes
+          label: "Routes"
+          description: Expose physical subnet routes to your entire Tailscale network.
+          schema:
+            type: string
+            default: ""
+        - variable: dest_ip
+          label: "Dest IP"
+          description: Tells the DNAT mechanism which Destination IP to set in the IP header, and where to send packets that are matched.
+          schema:
+            type: string
+            default: ""
+        - variable: sock5_server
+          label: "Sock5 Server"
+          schema:
+            type: string
+            default: ""
+        - variable: extra_args
+          label: "Extra Args"
+          schema:
+            type: string
+            default: ""
+# Include{containerConfig}
+# Include{serviceRoot}
+        - variable: main
+          label: "Main Service"
+          description: "The Primary service on which the healthcheck runs, often the webUI"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{serviceSelector}
+                    - variable: main
+                      label: "Main Service Port Configuration"
+                      schema:
+                        additional_attrs: true
+                        type: dict
+                        attrs:
+                          - variable: port
+                            label: "Port"
+                            description: "This port exposes the container port on the service"
+                            schema:
+                              type: int
+                              default: 41641
+                              required: true
+# Include{advancedPortUDP}
+                                - variable: targetPort
+                                  label: "Target Port"
+                                  description: "The internal(!) port on the container the Application runs on"
+                                  schema:
+                                    type: int
+                                    default: 41641
+# Include{serviceExpertRoot}
+            default: false
+# Include{serviceExpert}
+# Include{serviceList}
+# Include{persistenceRoot}
+        - variable: config
+          label: "App Config Storage"
+          description: "Stores the Application Configuration."
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{persistenceBasic}
+# Include{persistenceAdvanced}
+# Include{persistenceList}
+# Include{ingressRoot}
+        - variable: main
+          label: "Main Ingress"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{ingressDefault}
+# Include{ingressTLS}
+# Include{ingressTraefik}
+# Include{ingressExpert}
+# Include{ingressList}
+# Include{security}
+# Include{securityContextAdvancedRoot}
+              - variable: privileged
+                label: "Privileged mode"
+                schema:
+                  type: boolean
+                  default: false
+              - variable: readOnlyRootFilesystem
+                label: "ReadOnly Root Filesystem"
+                schema:
+                  type: boolean
+                  default: false
+              - variable: allowPrivilegeEscalation
+                label: "Allow Privilege Escalation"
+                schema:
+                  type: boolean
+                  default: false
+              - variable: runAsNonRoot
+                label: "runAsNonRoot"
+                schema:
+                  type: boolean
+                  default: false
+# Include{securityContextAdvanced}
+# Include{podSecurityContextRoot}
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: "The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+# Include{podSecurityContextAdvanced}
+# Include{resources}
+# Include{advanced}
+# Include{addons}
+# Include{documentation}
diff --git a/charts/incubator/tailscale/templates/_configmap.tpl b/charts/incubator/tailscale/templates/_configmap.tpl
new file mode 100644
index 00000000000..e7e1d45acbc
--- /dev/null
+++ b/charts/incubator/tailscale/templates/_configmap.tpl
@@ -0,0 +1,30 @@
+{{/* Define the secret */}}
+{{- define "tailscale.config" -}}
+
+{{- $configName := printf "%s-tailscale-config" (include "tc.common.names.fullname" .) }}
+{{- $secretName := printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $configName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  TS_KUBE_SECRET: {{ $secretName | squote }}
+  TS_USERSPACE: {{ .Values.tailscale.userspace | quote }}
+  TS_ACCEPT_DNS: {{ .Values.tailscale.accept_dns | quote }}
+  {{- with .Values.tailscale.routes }}
+  TS_ROUTES: {{ . }}
+  {{- end }}
+  {{- with .Values.tailscale.dest_ip }}
+  TS_DEST_IP: {{ . }}
+  {{- end }}
+  {{- with .Values.tailscale.sock5_server }}
+  TS_SOCK5_SERVER: {{ . }}
+  {{- end }}
+  {{- with .Values.tailscale.extra_args }}
+  TS_EXTRA_ARGS: {{ . | quote }}
+  {{- end }}
+{{- end }}
diff --git a/charts/incubator/tailscale/templates/_privelegednet.tpl b/charts/incubator/tailscale/templates/_privelegednet.tpl
new file mode 100644
index 00000000000..72f14e48f7e
--- /dev/null
+++ b/charts/incubator/tailscale/templates/_privelegednet.tpl
@@ -0,0 +1,15 @@
+{{- define "tailscale.tun" -}}
+---
+enabled: true
+type: hostPath
+hostPath: /dev/net/tun
+mountPath: /dev/net/tun
+hostPathType: ""
+readOnly: false
+{{- end }}
+
+{{- define "tailscale.caps" -}}
+---
+add:
+  - NET_ADMIN
+{{- end }}
diff --git a/charts/incubator/tailscale/templates/_secret.tpl b/charts/incubator/tailscale/templates/_secret.tpl
new file mode 100644
index 00000000000..73c68d0b2c6
--- /dev/null
+++ b/charts/incubator/tailscale/templates/_secret.tpl
@@ -0,0 +1,19 @@
+{{/* Define the secret */}}
+{{- define "tailscale.secret" -}}
+
+{{- $secretName := printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}
+
+---
+{{/* This secrets are loaded on tailscale */}}
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ $secretName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  {{- with .Values.tailscale.authkey }}
+  TS_AUTH_KEY: {{ . | b64enc }}
+  {{- end }}
+{{- end }}
diff --git a/charts/incubator/tailscale/templates/common.yaml b/charts/incubator/tailscale/templates/common.yaml
new file mode 100644
index 00000000000..0e3f9e2f8cc
--- /dev/null
+++ b/charts/incubator/tailscale/templates/common.yaml
@@ -0,0 +1,16 @@
+{{/* Make sure all variables are set properly */}}
+{{- include "tc.common.loader.init" . }}
+
+{{/* Render secret */}}
+{{- include "tailscale.secret" . }}
+
+{{/* Render config */}}
+{{- include "tailscale.config" . }}
+
+{{- if not .Values.tailscale.userspace }}
+{{- $_ := set .Values.persistence "tun" (include "tailscale.tun" . | fromYaml) -}}
+{{- $_ := set .Values.securityContext "capabilities" (include "tailscale.caps" . | fromYaml) -}}
+{{- end }}
+
+{{/* Render the templates */}}
+{{ include "tc.common.loader.apply" . }}
diff --git a/charts/incubator/tailscale/values.yaml b/charts/incubator/tailscale/values.yaml
new file mode 100644
index 00000000000..2a828c2f703
--- /dev/null
+++ b/charts/incubator/tailscale/values.yaml
@@ -0,0 +1,77 @@
+image:
+  repository: tccr.io/truecharts/tailscale
+  pullPolicy: IfNotPresent
+  tag: v1.29.125@sha256:fb2ad07557c351805a126d0056be083fb67e3b22abae12a18c52f1461b55ca55
+
+command: ["ash", "/tailscale/run.sh"]
+
+tty: true
+
+# Only un-comment this if you are going to have `userspace: false`
+# securityContext:
+#   readOnlyRootFilesystem: false
+#   runAsNonRoot: false
+
+# podSecurityContext:
+#   runAsUser: 0
+#   runAsGroup: 0
+
+serviceAccount:
+  main:
+    create: true
+
+rbac:
+  main:
+    enabled: true
+    rules:
+      - apiGroups:
+          - ""
+        resources:
+          - "secrets"
+        verbs:
+          - "create"
+      - apiGroups:
+          - ""
+        resources:
+          - "secrets"
+        resourceNames:
+          - '{{ printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}'
+        verbs:
+          - "get"
+          - "update"
+
+envFrom:
+  - configMapRef:
+      name: '{{ include "tc.common.names.fullname" . }}-tailscale-config'
+
+tailscale:
+  authkey: "supersecret"
+  userspace: true
+  accept_dns: false
+  routes: ""
+  dest_ip: ""
+  sock5_server: ""
+  extra_args: ""
+
+probes:
+  liveness:
+    enabled: false
+  readiness:
+    enabled: false
+  startup:
+    enabled: false
+
+service:
+  main:
+    ports:
+      main:
+        protocol: UDP
+        port: 41641
+
+persistence:
+  config:
+    enabled: true
+    mountPath: "/var/lib"
+
+portal:
+  enabled: false
diff --git a/cspell.config.yaml b/cspell.config.yaml
index 2af4e533b38..88e7c6480e9 100644
--- a/cspell.config.yaml
+++ b/cspell.config.yaml
@@ -5,6 +5,7 @@ words:
   - APITOKEN
   - appname
   - Authentik
+  - authkey
   - autoconnect
   - backupname
   - bazarr
@@ -20,6 +21,7 @@ words:
   - dbengine
   - ddns
   - Djava
+  - DNAT
   - dockerized
   - duplicati
   - dynmap
@@ -112,6 +114,7 @@ words:
   - subquestions
   - svcname
   - syncthing
+  - tailscale
   - targetport
   - tccr
   - teamspeak
@@ -120,6 +123,7 @@ words:
   - truenas
   - truetool
   - unifi
+  - userspace
   - valheim
   - vaultwarden
   - vdev