feat(tailscale): Install k8s operator

This commit is contained in:
Pim Kunis 2024-07-21 19:47:22 +02:00
parent 8fc6961362
commit cb6b883f6e
7 changed files with 66 additions and 89 deletions

View file

@ -176,6 +176,11 @@
module = "${self}/kubenix-modules/minecraft.nix";
namespace = "minecraft";
};
tailscale = {
module = "${self}/kubenix-modules/tailscale.nix";
namespace = "tailscale";
};
};
in
{

View file

@ -1,6 +1,5 @@
{ lib, nixhelm, system, machines, ... }: {
kubernetes = {
helm.releases = {
metallb = {
chart = nixhelm.chartsDerivations.${system}.metallb.metallb;
@ -48,6 +47,7 @@
dns = { };
media = { };
minecraft = { };
tailscale = { };
};
nodes =

View file

@ -1,91 +1,50 @@
{ lib, config, ... }:
let
cfg = config.lab.tailscale;
secretName = "tailscale-auth";
roleName = "tailscale";
sidecarContainername = "tailscale-sidecar";
in
{
{ lib, config, ... }: {
options = with lib.types; {
lab.tailscale = {
enable = lib.mkEnableOption "tailscale";
lab.tailscaleIngresses = lib.mkOption {
type = attrsOf (submodule {
options = {
host = lib.mkOption { type = str; };
allowedServiceAccounts = lib.mkOption {
type = listOf str;
service = {
name = lib.mkOption { type = str; };
description = ''
Allow specified service accounts to manage Tailscale authentication.
'';
};
deploymentsWithSidecarContainers = lib.mkOption {
type = attrsOf (submodule ({ name, ... }: {
options.hostName = lib.mkOption { type = str; };
}));
};
portName = lib.mkOption {
type = str;
default = "web";
};
};
};
});
};
};
config =
let
mkRoleBinding = name: {
name = "${name}-${roleName}";
value = {
subjects = [{
inherit name;
kind = "ServiceAccount";
cfg = config.lab.tailscaleIngresses;
mkTailscaleIngress = name: { host, service }: {
spec = {
ingressClassName = "tailscale";
rules = [{
http.paths = [{
path = "/";
pathType = "Prefix";
backend.service = {
name = service.name;
port.name = service.portName;
};
}];
}];
roleRef = {
kind = "Role";
name = roleName;
apiGroup = "rbac.authorization.k8s.io";
};
};
};
mkSidecarContainer = name: { hostName, ... }: {
spec.template.spec.containers.${sidecarContainername} = {
imagePullPolicy = "Always";
image = "ghcr.io/tailscale/tailscale:latest";
env = {
TS_HOSTNAME.value = hostName;
TS_KUBE_SECRET.value = secretName;
TS_USERSPACE.value = "false";
TS_DEBUG_FIREWALL_MODE.value = "auto";
TS_AUTHKEY.valueFrom.secretKeyRef = {
name = secretName;
key = "TS_AUTHKEY";
optional = true;
};
};
securityContext.capabilities.add = [ "NET_ADMIN" ];
tls = [{
hosts = [ host ];
}];
};
};
in
{
kubernetes.resources = lib.mkIf cfg.enable {
secrets.${secretName}.stringData.TS_AUTHKEY = "ref+sops://secrets/kubernetes.yaml#/tailscale/authKey";
roles.${roleName}.rules = [
{
apiGroups = [ "" ];
resources = [ "secrets" ];
verbs = [ "create" ];
}
{
apiGroups = [ "" ];
resourceNames = [ secretName ];
resources = [ "secrets" ];
verbs = [ "get" "update" "patch" ];
}
];
roleBindings = builtins.listToAttrs (map mkRoleBinding cfg.allowedServiceAccounts);
deployments = builtins.mapAttrs mkSidecarContainer cfg.deploymentsWithSidecarContainers;
};
kubernetes.resources.ingresses = builtins.mapAttrs mkTailscaleIngress cfg;
};
}

View file

@ -15,10 +15,8 @@
inbucket = {
image = "inbucket/inbucket:edge";
env.INBUCKET_WEB_ADDR.value = "0.0.0.0:80";
ports = {
web.containerPort = 80;
web.containerPort = 9000;
smtp.containerPort = 2500;
};
};
@ -52,9 +50,8 @@
};
};
lab.tailscale = {
enable = true;
allowedServiceAccounts = [ "inbucket" ];
deploymentsWithSidecarContainers.inbucket.hostName = "inbucket";
lab.tailscaleIngresses.tailscale = {
host = "inbucket";
service.name = "web";
};
}

View file

@ -79,10 +79,9 @@
storage = "400Mi";
};
tailscale = {
enable = true;
allowedServiceAccounts = [ "syncthing" ];
deploymentsWithSidecarContainers.syncthing.hostName = "syncthing";
tailscaleIngresses.tailscale = {
host = "sync";
service.name = "syncthing";
};
};
}

View file

@ -0,0 +1,14 @@
{ nixhelm, system, ... }: {
kubernetes = {
helm.releases.tailscale = {
chart = nixhelm.chartsDerivations.${system}.tailscale.tailscale-operator;
includeCRDs = true;
namespace = "tailscale";
};
resources.secrets.operator-oauth.stringData = {
client_id = "ref+sops://secrets/kubernetes.yaml#/tailscale/oauth/clientID";
client_secret = "ref+sops://secrets/kubernetes.yaml#/tailscale/oauth/clientSecret";
};
};
}

View file

@ -28,6 +28,9 @@ immich:
databasePassword: ENC[AES256_GCM,data:fZtGYiHOhYjdzBxaSdnstjlOAJE=,iv:YV+o4upajDHtwWSU6Z9h3Ncl9fXbo65KT6YMqlh2evY=,tag:BWLRc3bdnS9M70jC3SZXlA==,type:str]
tailscale:
authKey: ENC[AES256_GCM,data:pBbrL6/HVxDgvEeVHdnH6O3YsUB4tpRCO7SacYxSunDcMg8xcIXWWx1Zt65z9hcMcW/2AZbXC8mh+UPBRw==,iv:tTXdEAgCAHL46nN6yO0QNwJ0DUltAmQ/359TzuqXrpI=,tag:F7DtCigCRhdPBgMK3ZzV7g==,type:str]
oauth:
clientID: ENC[AES256_GCM,data:HLkgZ2q79LSBDCrwgzErNVE=,iv:/877rL2F/r4yxhGXaZW/TsbaU0arBKJiH9arTqfStrk=,tag:lVLJJ/D19FoSJXLu7S3ByQ==,type:str]
clientSecret: ENC[AES256_GCM,data:AsgE6KYXP8Z/2c4WdxWOou62txjz/TNarlQn6osebPB3czVVlGky4d4KcDE2cMgXqIEY3E/LNxbjMnfxIC9s,iv:EQDN/ECzIkKXtfj2DE0JtgXEpRMMEbYbfYDMxwXkx5E=,tag:NXwbzQv38njh+a5O8kQOag==,type:str]
sops:
kms: []
gcp_kms: []
@ -52,8 +55,8 @@ sops:
aHpYZ2VtdVBVTkxZbGFOYzRpbGltZHMKJs4E+CsthuzQZqA0Yip4G/1XK4SuoiRP
Lo65L33lfNibdSOeIygqnyo6GBwjD52TcNQpvzkVbr3M3hWlJs8wCA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-07-18T09:03:54Z"
mac: ENC[AES256_GCM,data:BEgztutw7barzGcbx5hkfAnauPv2H4nvwZM5iUfPJcjOkPsKTVwYAcdDdJE8wL2Nc9b4iIGSRwf9fwizyaerPR6SFt1zNHgbQz0DbUz+j/bUIXwKBSQNgK0KjiX8ONyFK62OxAhEa600OUV0cqWURUwRl+F8fRQSqQCvKuREVyE=,iv:ZMj4NAVI94bM/HwYSkZIN9hRPXWR1miIld57EeC+ckk=,tag:wy2ENtExu2mtpFPc/jy+nw==,type:str]
lastmodified: "2024-07-21T16:43:44Z"
mac: ENC[AES256_GCM,data:Gx9Zpdt/HzeYRj2ksmCGLaIJTcsfzxJklGdVNbtMIU888A32B72lAHfv0MbU5OBX0ZRt+VYDRncARSeTKPI3CGZu0qLtJwkDcVFGv+y+sea63DN8mmvNpYLQeif0daqE1GGMPVWukzV/2aBmfWbYBtHhm3C2v4f7KXobE83v3K0=,iv:bd+U7zyGOeH2Wq+y4RRv7kGfDkUGq1Kkfj4LOFdMJkY=,tag:5JkuFvY8kFfguBJoZfOnvg==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1