feat(tailscale): Install k8s operator

kubenix-modules/custom/tailscale.nix

@@ -1,91 +1,50 @@
-{ lib, config, ... }:
-let
-  cfg = config.lab.tailscale;
-  secretName = "tailscale-auth";
-  roleName = "tailscale";
-  sidecarContainername = "tailscale-sidecar";
-in
-{
+{ lib, config, ... }: {
   options = with lib.types; {
-    lab.tailscale = {
-      enable = lib.mkEnableOption "tailscale";
+    lab.tailscaleIngresses = lib.mkOption {
+      type = attrsOf (submodule {
+        options = {
+          host = lib.mkOption { type = str; };
 
-      allowedServiceAccounts = lib.mkOption {
-        type = listOf str;
+          service = {
+            name = lib.mkOption { type = str; };
 
-        description = ''
-          Allow specified service accounts to manage Tailscale authentication.
-        '';
-      };
-
-      deploymentsWithSidecarContainers = lib.mkOption {
-        type = attrsOf (submodule ({ name, ... }: {
-          options.hostName = lib.mkOption { type = str; };
-        }));
-      };
+            portName = lib.mkOption {
+              type = str;
+              default = "web";
+            };
+          };
+        };
+      });
     };
   };
 
   config =
     let
-      mkRoleBinding = name: {
-        name = "${name}-${roleName}";
-        value = {
-          subjects = [{
-            inherit name;
-            kind = "ServiceAccount";
+      cfg = config.lab.tailscaleIngresses;
+
+      mkTailscaleIngress = name: { host, service }: {
+        spec = {
+          ingressClassName = "tailscale";
+
+          rules = [{
+            http.paths = [{
+              path = "/";
+              pathType = "Prefix";
+
+              backend.service = {
+                name = service.name;
+                port.name = service.portName;
+              };
+            }];
           }];
 
-          roleRef = {
-            kind = "Role";
-            name = roleName;
-            apiGroup = "rbac.authorization.k8s.io";
-          };
-        };
-      };
-
-      mkSidecarContainer = name: { hostName, ... }: {
-        spec.template.spec.containers.${sidecarContainername} = {
-          imagePullPolicy = "Always";
-          image = "ghcr.io/tailscale/tailscale:latest";
-
-          env = {
-            TS_HOSTNAME.value = hostName;
-            TS_KUBE_SECRET.value = secretName;
-            TS_USERSPACE.value = "false";
-            TS_DEBUG_FIREWALL_MODE.value = "auto";
-            TS_AUTHKEY.valueFrom.secretKeyRef = {
-              name = secretName;
-              key = "TS_AUTHKEY";
-              optional = true;
-            };
-          };
-
-          securityContext.capabilities.add = [ "NET_ADMIN" ];
+          tls = [{
+            hosts = [ host ];
+          }];
         };
       };
     in
     {
-      kubernetes.resources = lib.mkIf cfg.enable {
-        secrets.${secretName}.stringData.TS_AUTHKEY = "ref+sops://secrets/kubernetes.yaml#/tailscale/authKey";
-
-        roles.${roleName}.rules = [
-          {
-            apiGroups = [ "" ];
-            resources = [ "secrets" ];
-            verbs = [ "create" ];
-          }
-          {
-            apiGroups = [ "" ];
-            resourceNames = [ secretName ];
-            resources = [ "secrets" ];
-            verbs = [ "get" "update" "patch" ];
-          }
-        ];
-
-        roleBindings = builtins.listToAttrs (map mkRoleBinding cfg.allowedServiceAccounts);
-
-        deployments = builtins.mapAttrs mkSidecarContainer cfg.deploymentsWithSidecarContainers;
-      };
+      kubernetes.resources.ingresses = builtins.mapAttrs mkTailscaleIngress cfg;
     };
 }