David Bond
eb03d42fe6
This commit modifies the kubernetes operator to allow for customisation of the tailscale login url. This provides some data locality for people that want to configure it. This value is set in the `loginServer` helm value and is propagated down to all resources managed by the operator. The only exception to this is recorder nodes, where additional changes are required to support modifying the url. Updates https://github.com/tailscale/corp/issues/29847 Signed-off-by: David Bond <davidsbond93@gmail.com>
117 lines
4.3 KiB
YAML
117 lines
4.3 KiB
YAML
# Copyright (c) Tailscale Inc & AUTHORS
|
|
# SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: operator
|
|
namespace: {{ .Release.Namespace }}
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: operator
|
|
template:
|
|
metadata:
|
|
{{- with .Values.operatorConfig.podAnnotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
labels:
|
|
app: operator
|
|
{{- with .Values.operatorConfig.podLabels }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
serviceAccountName: operator
|
|
{{- with .Values.operatorConfig.podSecurityContext }}
|
|
securityContext:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: oauth
|
|
{{- with .Values.oauthSecretVolume }}
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- else }}
|
|
secret:
|
|
secretName: operator-oauth
|
|
{{- end }}
|
|
containers:
|
|
- name: operator
|
|
{{- with .Values.operatorConfig.securityContext }}
|
|
securityContext:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- with .Values.operatorConfig.resources }}
|
|
resources:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- $operatorTag:= printf ":%s" ( .Values.operatorConfig.image.tag | default .Chart.AppVersion )}}
|
|
image: {{ coalesce .Values.operatorConfig.image.repo .Values.operatorConfig.image.repository }}{{- if .Values.operatorConfig.image.digest -}}{{ printf "@%s" .Values.operatorConfig.image.digest}}{{- else -}}{{ printf "%s" $operatorTag }}{{- end }}
|
|
imagePullPolicy: {{ .Values.operatorConfig.image.pullPolicy }}
|
|
env:
|
|
- name: OPERATOR_INITIAL_TAGS
|
|
value: {{ join "," .Values.operatorConfig.defaultTags }}
|
|
- name: OPERATOR_HOSTNAME
|
|
value: {{ .Values.operatorConfig.hostname }}
|
|
- name: OPERATOR_SECRET
|
|
value: operator
|
|
- name: OPERATOR_LOGGING
|
|
value: {{ .Values.operatorConfig.logging }}
|
|
- name: OPERATOR_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: OPERATOR_LOGIN_SERVER
|
|
value: {{ .Values.operatorConfig.loginServer }}
|
|
- name: CLIENT_ID_FILE
|
|
value: /oauth/client_id
|
|
- name: CLIENT_SECRET_FILE
|
|
value: /oauth/client_secret
|
|
{{- $proxyTag := printf ":%s" ( .Values.proxyConfig.image.tag | default .Chart.AppVersion )}}
|
|
- name: PROXY_IMAGE
|
|
value: {{ coalesce .Values.proxyConfig.image.repo .Values.proxyConfig.image.repository }}{{- if .Values.proxyConfig.image.digest -}}{{ printf "@%s" .Values.proxyConfig.image.digest}}{{- else -}}{{ printf "%s" $proxyTag }}{{- end }}
|
|
- name: PROXY_TAGS
|
|
value: {{ .Values.proxyConfig.defaultTags }}
|
|
- name: APISERVER_PROXY
|
|
value: "{{ .Values.apiServerProxyConfig.mode }}"
|
|
- name: PROXY_FIREWALL_MODE
|
|
value: {{ .Values.proxyConfig.firewallMode }}
|
|
{{- if .Values.proxyConfig.defaultProxyClass }}
|
|
- name: PROXY_DEFAULT_CLASS
|
|
value: {{ .Values.proxyConfig.defaultProxyClass }}
|
|
{{- end }}
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: POD_UID
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.uid
|
|
{{- with .Values.operatorConfig.extraEnv }}
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
volumeMounts:
|
|
- name: oauth
|
|
mountPath: /oauth
|
|
readOnly: true
|
|
{{- with .Values.operatorConfig.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.operatorConfig.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.operatorConfig.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|