cmd/k8s-operator: workload identity support for multi-tailnet (#20016)

This commit modifies the reconciler for the `Tailnet` custom resource
to allow referenced secrets to specify an `audience` field. If a
referenced secret contains both an `audience` and `client_id` we assume
the user's intention is to use workload identity.

In that case, we configure the tailscale API client to authenticate
using the Kubernetes token request API against the operator's service
account. This requires the operator to be aware of its own service
account name.

A small change has also been made to the messages added to the `Tailnet`
CRD's status field in the even that it is missing scopes to make it
clearer that certain scopes may not be applied.

Closes: #19090
Updates: #19471

Signed-off-by: David Bond <davidsbond93@gmail.com>

cmd/k8s-operator/deploy/chart/templates/deployment.yaml

@@ -81,6 +81,10 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
+            - name: OPERATOR_SERVICE_ACCOUNT_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.serviceAccountName
             - name: OPERATOR_LOGIN_SERVER
               value: {{ .Values.loginServer }}
             - name: OPERATOR_INGRESS_CLASS_NAME

cmd/k8s-operator/deploy/chart/templates/operator-rbac.yaml

@@ -76,6 +76,10 @@ rules:
 - apiGroups: [""]
   resources: ["secrets", "serviceaccounts", "configmaps"]
   verbs: ["create","delete","deletecollection","get","list","patch","update","watch"]
+- apiGroups: [""]
+  resources: ["serviceaccounts/token"]
+  resourceNames: ["operator"]
+  verbs: ["create"]
 - apiGroups: [""]
   resources: ["pods"]
   verbs: ["get","list","watch", "update"]

cmd/k8s-operator/deploy/crds/tailscale.com_tailnets.yaml

@@ -58,15 +58,18 @@ spec:
                 - credentials
               properties:
                 credentials:
-                  description: Denotes the location of the OAuth credentials to use for authenticating with this Tailnet.
+                  description: Denotes the location of the credentials to use for authenticating with this Tailnet.
                   type: object
                   required:
                     - secretName
                   properties:
                     secretName:
                       description: |-
-                        The name of the secret containing the OAuth credentials. This secret must contain two fields "client_id" and
-                        "client_secret".
+                        The name of the secret containing the credentials used to authenticate with this Tailnet. The secret must always
+                        contain a "client_id" field. To authenticate with a static OAuth client, also set "client_secret". To authenticate
+                        via workload identity federation, set "audience" to the audience value expected by the Tailscale OAuth
+                        client; the operator will mint a ServiceAccount token for itself with that audience and exchange it for an API
+                        token. "client_secret" and "audience" are mutually exclusive.
                       type: string
                 loginUrl:
                   description: URL of the control plane to be used by all resources managed by the operator using this Tailnet.

cmd/k8s-operator/deploy/manifests/operator.yaml

@@ -6151,12 +6151,15 @@ spec:
                             https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
                         properties:
                             credentials:
-                                description: Denotes the location of the OAuth credentials to use for authenticating with this Tailnet.
+                                description: Denotes the location of the credentials to use for authenticating with this Tailnet.
                                 properties:
                                     secretName:
                                         description: |-
-                                            The name of the secret containing the OAuth credentials. This secret must contain two fields "client_id" and
-                                            "client_secret".
+                                            The name of the secret containing the credentials used to authenticate with this Tailnet. The secret must always
+                                            contain a "client_id" field. To authenticate with a static OAuth client, also set "client_secret". To authenticate
+                                            via workload identity federation, set "audience" to the audience value expected by the Tailscale OAuth
+                                            client; the operator will mint a ServiceAccount token for itself with that audience and exchange it for an API
+                                            token. "client_secret" and "audience" are mutually exclusive.
                                         type: string
                                 required:
                                     - secretName
@@ -6409,6 +6412,14 @@ rules:
         - patch
         - update
         - watch
+    - apiGroups:
+        - ""
+      resourceNames:
+        - operator
+      resources:
+        - serviceaccounts/token
+      verbs:
+        - create
     - apiGroups:
         - ""
       resources:
@@ -6560,6 +6571,10 @@ spec:
                       valueFrom:
                         fieldRef:
                             fieldPath: metadata.namespace
+                    - name: OPERATOR_SERVICE_ACCOUNT_NAME
+                      valueFrom:
+                        fieldRef:
+                            fieldPath: spec.serviceAccountName
                     - name: OPERATOR_LOGIN_SERVER
                       value: null
                     - name: OPERATOR_INGRESS_CLASS_NAME