feat(tailscale): add tailscale (#3488)

* feat(tailscale): add tailscale

* env

* see logs without env

* try something

* render configmap and adjust script

* perms

* call it differently

* mount tmp

* in ram

* disable temp

* change pers path

* sysmod cap

* no messaeg

* fsgrp 0

* puid0

* hostnet

* service

* priv?

* use the included script

* common

* secret

* try with sa and rbac

* secretname

* render sercet

* excelent copy paster

* set tskubesec

* disable probes and remove portal

* without sys_mod

* empty space

* add configmap

* render

* copy paste specialist

* lowercase

* hmm

* different

* again

* and try again

* again

* uhm

* quote?

* wth

* enc secret

* enable tty

* mm

* remove configmap for now

* reenable configmap

* I'M STUPIDDDD

* enable config map

* conditionally add tun

* conditionaly add caps aswell

* update desc

* now test unprevileged

* rootless

* try nonuser-space + rootless

* add docs and remove env (its defined in configmap already)

* Update charts/incubator/tailscale/values.yaml

* Update charts/incubator/tailscale/values.yaml

* Update charts/incubator/tailscale/templates/_configmap.tpl

* add sock5 and descriptions

charts/incubator/tailscale/.helmignore

@@ -0,0 +1,30 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# OWNERS file for Kubernetes
+OWNERS
+# helm-docs templates
+*.gotmpl
+# docs folder
+/docs
+# icon
+icon.png

charts/incubator/tailscale/Chart.yaml

@@ -0,0 +1,27 @@
+apiVersion: v2
+appVersion: "10.6.2"
+dependencies:
+  - name: common
+    repository: https://library-charts.truecharts.org
+    version: 10.4.12
+description: Tailscale lets you connect your devices and users together in your own secure virtual private network
+home: https://truecharts.org/docs/charts/stable/airsonic
+icon: https://truecharts.org/img/hotlink-ok/chart-icons/airsonic.png
+keywords:
+  - vpn
+  - tailscale
+kubeVersion: ">=1.16.0-0"
+maintainers:
+  - email: info@truecharts.org
+    name: TrueCharts
+    url: https://truecharts.org
+name: tailscale
+sources:
+  - https://hub.docker.com/r/tailscale/tailscale
+  - https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh
+version: 0.0.1
+annotations:
+  truecharts.org/catagories: |
+    - network
+  truecharts.org/SCALE-support: "true"
+  truecharts.org/grade: U

charts/incubator/tailscale/docs/installation_notes.md

@@ -0,0 +1,19 @@
+# Installation Notes
+
+If you want to use `Tailscale` in **non**-user mode, you have to run this as `root` user.
+You can do this by editing the following
+
+Under `Tailscale Configuration`
+
+- Uncheck `Userspace`
+
+Under `Security and Permissions`
+
+- Check `Show Advanced Security Settings`
+  - Uncheck `ReadOnly Root Filesystem`
+  - Uncheck `runAsNonRoot`
+
+Under `Pod Security Context`
+
+- runAsUser: `0`
+- runAsGroup: `0`

charts/incubator/tailscale/questions.yaml

@@ -0,0 +1,164 @@
+# Include{groups}
+portals: {}
+questions:
+# Include{global}
+# Include{controller}
+# Include{controllerDeployment}
+# Include{replicas}
+# Include{replica1}
+# Include{strategy}
+# Include{recreate}
+# Include{controllerExpert}
+# Include{controllerExpertExtraArgs}
+  - variable: tailscale
+    group: "Container Configuration"
+    label: "Tailscale Configuration"
+    schema:
+      additional_attrs: true
+      type: dict
+      attrs:
+        - variable: authkey
+          label: "Auth Key"
+          description: "Provide an auth key to automatically authenticate the node as your user account."
+          schema:
+            type: string
+            private: true
+            default: ""
+        - variable: userspace
+          label: "Userspace"
+          description: "Userspace Networking mode allows running Tailscale where you don't have access to create a VPN tunnel device."
+          schema:
+            type: boolean
+            default: true
+        - variable: accept_dns
+          label: "Accept DNS"
+          description: "Accept DNS configuration from the admin console."
+          schema:
+            type: boolean
+            default: false
+        - variable: routes
+          label: "Routes"
+          description: Expose physical subnet routes to your entire Tailscale network.
+          schema:
+            type: string
+            default: ""
+        - variable: dest_ip
+          label: "Dest IP"
+          description: Tells the DNAT mechanism which Destination IP to set in the IP header, and where to send packets that are matched.
+          schema:
+            type: string
+            default: ""
+        - variable: sock5_server
+          label: "Sock5 Server"
+          schema:
+            type: string
+            default: ""
+        - variable: extra_args
+          label: "Extra Args"
+          schema:
+            type: string
+            default: ""
+# Include{containerConfig}
+# Include{serviceRoot}
+        - variable: main
+          label: "Main Service"
+          description: "The Primary service on which the healthcheck runs, often the webUI"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{serviceSelector}
+                    - variable: main
+                      label: "Main Service Port Configuration"
+                      schema:
+                        additional_attrs: true
+                        type: dict
+                        attrs:
+                          - variable: port
+                            label: "Port"
+                            description: "This port exposes the container port on the service"
+                            schema:
+                              type: int
+                              default: 41641
+                              required: true
+# Include{advancedPortUDP}
+                                - variable: targetPort
+                                  label: "Target Port"
+                                  description: "The internal(!) port on the container the Application runs on"
+                                  schema:
+                                    type: int
+                                    default: 41641
+# Include{serviceExpertRoot}
+            default: false
+# Include{serviceExpert}
+# Include{serviceList}
+# Include{persistenceRoot}
+        - variable: config
+          label: "App Config Storage"
+          description: "Stores the Application Configuration."
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{persistenceBasic}
+# Include{persistenceAdvanced}
+# Include{persistenceList}
+# Include{ingressRoot}
+        - variable: main
+          label: "Main Ingress"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{ingressDefault}
+# Include{ingressTLS}
+# Include{ingressTraefik}
+# Include{ingressExpert}
+# Include{ingressList}
+# Include{security}
+# Include{securityContextAdvancedRoot}
+              - variable: privileged
+                label: "Privileged mode"
+                schema:
+                  type: boolean
+                  default: false
+              - variable: readOnlyRootFilesystem
+                label: "ReadOnly Root Filesystem"
+                schema:
+                  type: boolean
+                  default: false
+              - variable: allowPrivilegeEscalation
+                label: "Allow Privilege Escalation"
+                schema:
+                  type: boolean
+                  default: false
+              - variable: runAsNonRoot
+                label: "runAsNonRoot"
+                schema:
+                  type: boolean
+                  default: false
+# Include{securityContextAdvanced}
+# Include{podSecurityContextRoot}
+        - variable: runAsUser
+          label: "runAsUser"
+          description: "The UserID of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: runAsGroup
+          label: "runAsGroup"
+          description: "The groupID this App of the user running the application"
+          schema:
+            type: int
+            default: 0
+        - variable: fsGroup
+          label: "fsGroup"
+          description: "The group that should own ALL storage."
+          schema:
+            type: int
+            default: 568
+# Include{podSecurityContextAdvanced}
+# Include{resources}
+# Include{advanced}
+# Include{addons}
+# Include{documentation}

charts/incubator/tailscale/templates/_configmap.tpl

@@ -0,0 +1,30 @@
+{{/* Define the secret */}}
+{{- define "tailscale.config" -}}
+
+{{- $configName := printf "%s-tailscale-config" (include "tc.common.names.fullname" .) }}
+{{- $secretName := printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $configName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  TS_KUBE_SECRET: {{ $secretName | squote }}
+  TS_USERSPACE: {{ .Values.tailscale.userspace | quote }}
+  TS_ACCEPT_DNS: {{ .Values.tailscale.accept_dns | quote }}
+  {{- with .Values.tailscale.routes }}
+  TS_ROUTES: {{ . }}
+  {{- end }}
+  {{- with .Values.tailscale.dest_ip }}
+  TS_DEST_IP: {{ . }}
+  {{- end }}
+  {{- with .Values.tailscale.sock5_server }}
+  TS_SOCK5_SERVER: {{ . }}
+  {{- end }}
+  {{- with .Values.tailscale.extra_args }}
+  TS_EXTRA_ARGS: {{ . | quote }}
+  {{- end }}
+{{- end }}

charts/incubator/tailscale/templates/_privelegednet.tpl

@@ -0,0 +1,15 @@
+{{- define "tailscale.tun" -}}
+---
+enabled: true
+type: hostPath
+hostPath: /dev/net/tun
+mountPath: /dev/net/tun
+hostPathType: ""
+readOnly: false
+{{- end }}
+
+{{- define "tailscale.caps" -}}
+---
+add:
+  - NET_ADMIN
+{{- end }}

charts/incubator/tailscale/templates/_secret.tpl

@@ -0,0 +1,19 @@
+{{/* Define the secret */}}
+{{- define "tailscale.secret" -}}
+
+{{- $secretName := printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}
+
+---
+{{/* This secrets are loaded on tailscale */}}
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ $secretName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  {{- with .Values.tailscale.authkey }}
+  TS_AUTH_KEY: {{ . | b64enc }}
+  {{- end }}
+{{- end }}

charts/incubator/tailscale/templates/common.yaml

@@ -0,0 +1,16 @@
+{{/* Make sure all variables are set properly */}}
+{{- include "tc.common.loader.init" . }}
+
+{{/* Render secret */}}
+{{- include "tailscale.secret" . }}
+
+{{/* Render config */}}
+{{- include "tailscale.config" . }}
+
+{{- if not .Values.tailscale.userspace }}
+{{- $_ := set .Values.persistence "tun" (include "tailscale.tun" . | fromYaml) -}}
+{{- $_ := set .Values.securityContext "capabilities" (include "tailscale.caps" . | fromYaml) -}}
+{{- end }}
+
+{{/* Render the templates */}}
+{{ include "tc.common.loader.apply" . }}

charts/incubator/tailscale/values.yaml

@@ -0,0 +1,77 @@
+image:
+  repository: tccr.io/truecharts/tailscale
+  pullPolicy: IfNotPresent
+  tag: v1.29.125@sha256:fb2ad07557c351805a126d0056be083fb67e3b22abae12a18c52f1461b55ca55
+
+command: ["ash", "/tailscale/run.sh"]
+
+tty: true
+
+# Only un-comment this if you are going to have `userspace: false`
+# securityContext:
+#   readOnlyRootFilesystem: false
+#   runAsNonRoot: false
+
+# podSecurityContext:
+#   runAsUser: 0
+#   runAsGroup: 0
+
+serviceAccount:
+  main:
+    create: true
+
+rbac:
+  main:
+    enabled: true
+    rules:
+      - apiGroups:
+          - ""
+        resources:
+          - "secrets"
+        verbs:
+          - "create"
+      - apiGroups:
+          - ""
+        resources:
+          - "secrets"
+        resourceNames:
+          - '{{ printf "%s-tailscale-secret" (include "tc.common.names.fullname" .) }}'
+        verbs:
+          - "get"
+          - "update"
+
+envFrom:
+  - configMapRef:
+      name: '{{ include "tc.common.names.fullname" . }}-tailscale-config'
+
+tailscale:
+  authkey: "supersecret"
+  userspace: true
+  accept_dns: false
+  routes: ""
+  dest_ip: ""
+  sock5_server: ""
+  extra_args: ""
+
+probes:
+  liveness:
+    enabled: false
+  readiness:
+    enabled: false
+  startup:
+    enabled: false
+
+service:
+  main:
+    ports:
+      main:
+        protocol: UDP
+        port: 41641
+
+persistence:
+  config:
+    enabled: true
+    mountPath: "/var/lib"
+
+portal:
+  enabled: false

cspell.config.yaml

@@ -5,6 +5,7 @@ words:
   - APITOKEN
   - appname
   - Authentik
+  - authkey
   - autoconnect
   - backupname
   - bazarr
@@ -20,6 +21,7 @@ words:
   - dbengine
   - ddns
   - Djava
+  - DNAT
   - dockerized
   - duplicati
   - dynmap
@@ -112,6 +114,7 @@ words:
   - subquestions
   - svcname
   - syncthing
+  - tailscale
   - targetport
   - tccr
   - teamspeak
@@ -120,6 +123,7 @@ words:
   - truenas
   - truetool
   - unifi
+  - userspace
   - valheim
   - vaultwarden
   - vdev