Skip to content

Commit 17a30aa

Browse files
murrayjumurrayju
committed
tailscale proxy
1 parent 5549f60 commit 17a30aa

File tree

7 files changed

+162
-10
lines changed

7 files changed

+162
-10
lines changed

‎README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,11 @@ kubectl -n savannah-system create secret generic tiger-docs-mcp-server-logfire \
150150
--dry-run=client \
151151
--from-literal=token="pylf_v1_us_" \
152152
-o yaml | kubeseal -o yaml
153+
154+
kubectl -n savannah-system create secret generic tiger-docs-mcp-server-tailscale \
155+
--dry-run=client \
156+
--from-literal=authkey="tskey-auth-" \
157+
-o yaml | kubeseal -o yaml
153158
```
154159

155160
Update `./chart/values/dev.yaml` with the output.

‎chart/templates/sealed-secret-tailscale.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: bitnami.com/v1alpha1
2+
kind: SealedSecret
3+
metadata:
4+
name: {{ .Values.name }}-tailscale
5+
namespace: {{ .Release.Namespace }}
6+
spec:
7+
encryptedData:
8+
authkey: {{ .Values.tailscale.authkey }}
9+
template:
10+
metadata:
11+
creationTimestamp: null
12+
name: {{ .Values.name }}-tailscale
13+
namespace: {{ .Release.Namespace }}

‎chart/templates/service.yaml‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,24 +2,15 @@
22
apiVersion: v1
33
kind: Service
44
metadata:
5-
annotations:
6-
external-dns.alpha.kubernetes.io/hostname: {{ .Values.name }}.ops.dev.timescale.com
7-
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
8-
service.beta.kubernetes.io/aws-load-balancer-internal: "true"
9-
service.beta.kubernetes.io/aws-load-balancer-type: nlb
105
namespace: {{ .Release.Namespace }}
116
name: {{ .Values.name }}
127
labels:
138
app: {{ .Values.name }}
14-
app.kubernetes.io/name: {{ .Values.name }}
159
spec:
1610
selector:
1711
app: {{ .Values.name }}
1812
ports:
1913
- port: {{ .Values.servicePort }}
2014
targetPort: {{ .Values.containerPort }}
2115
protocol: TCP
22-
type: LoadBalancer
23-
sessionAffinity: None
24-
externalTrafficPolicy: Local
25-
internalTrafficPolicy: Cluster
16+
type: ClusterIP

‎chart/templates/tailscale-service-account.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ .Values.name }}-tailscale
6+
namespace: {{ .Release.Namespace }}
7+
---
8+
apiVersion: rbac.authorization.k8s.io/v1
9+
kind: Role
10+
metadata:
11+
name: {{ .Values.name }}-tailscale
12+
namespace: {{ .Release.Namespace }}
13+
rules:
14+
- apiGroups: [""] # "" indicates the core API group
15+
resources: ["secrets"]
16+
# Create can not be restricted to a resource name.
17+
verbs: ["create"]
18+
- apiGroups: [""] # "" indicates the core API group
19+
resourceNames: ["{{ .Values.name }}-tailscale"]
20+
resources: ["secrets"]
21+
verbs: ["get", "update", "patch"]
22+
- apiGroups: [""] # "" indicates the core API group
23+
resources: ["events"]
24+
verbs: ["get", "create", "patch"]
25+
---
26+
apiVersion: rbac.authorization.k8s.io/v1
27+
kind: RoleBinding
28+
metadata:
29+
name: {{ .Values.name }}-tailscale
30+
namespace: {{ .Release.Namespace }}
31+
subjects:
32+
- kind: ServiceAccount
33+
name: {{ .Values.name }}-tailscale
34+
roleRef:
35+
kind: Role
36+
name: {{ .Values.name }}-tailscale
37+
apiGroup: rbac.authorization.k8s.io

‎chart/templates/tailscale.yaml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
namespace: {{ .Release.Namespace }}
6+
name: {{ .Values.name }}-tailscale
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
app: {{ .Values.name }}-tailscale
12+
template:
13+
metadata:
14+
labels:
15+
app: {{ .Values.name }}-tailscale
16+
spec:
17+
serviceAccountName: {{ .Values.name }}-tailscale
18+
containers:
19+
- name: {{ .Values.name }}-tailscale
20+
image: tailscale/tailscale:latest
21+
env:
22+
- name: TS_AUTHKEY
23+
valueFrom:
24+
secretKeyRef:
25+
name: {{ .Values.name }}-tailscale
26+
key: authkey
27+
- name: TS_KUBE_SECRET
28+
value: {{ .Values.name }}-tailscale
29+
- name: TS_HOSTNAME
30+
value: {{ .Values.name }}
31+
- name: TS_SERVE_CONFIG
32+
value: /config/ts-serve-config.json
33+
- name: POD_NAME
34+
valueFrom:
35+
fieldRef:
36+
fieldPath: metadata.name
37+
- name: POD_UID
38+
valueFrom:
39+
fieldRef:
40+
fieldPath: metadata.uid
41+
volumeMounts:
42+
- name: serve-config
43+
mountPath: /config
44+
readOnly: true
45+
securityContext:
46+
capabilities:
47+
add:
48+
- NET_ADMIN
49+
volumes:
50+
- name: serve-config
51+
configMap:
52+
name: {{ .Values.name }}-tailscale-serve-config
53+
---
54+
apiVersion: v1
55+
kind: ConfigMap
56+
metadata:
57+
namespace: {{ .Release.Namespace }}
58+
name: {{ .Values.name }}-tailscale-serve-config
59+
data:
60+
ts-serve-config.json: |
61+
{
62+
"TCP": {
63+
"80": {
64+
"HTTP": true
65+
},
66+
"443": {
67+
"HTTPS": true
68+
}
69+
},
70+
"Web": {
71+
"{{ .Values.name }}.{{ .Values.tailscale.tailnet }}:443": {
72+
"Handlers": {
73+
"/": {
74+
"Proxy": "http://{{ .Values.name }}:80"
75+
}
76+
}
77+
},
78+
"{{ .Values.name }}.{{ .Values.tailscale.tailnet }}:80": {
79+
"Handlers": {
80+
"/": {
81+
"Proxy": "http://{{ .Values.name }}:80"
82+
}
83+
}
84+
},
85+
"{{ .Values.name }}:80": {
86+
"Handlers": {
87+
"/": {
88+
"Proxy": "http://{{ .Values.name }}:80"
89+
}
90+
}
91+
},
92+
":80": {
93+
"Handlers": {
94+
"/": {
95+
"Proxy": "http://{{ .Values.name }}:80"
96+
}
97+
}
98+
}
99+
}
100+
}

‎chart/values.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ logfire:
3333
tracesEndpoint: https://logfire-api.pydantic.dev/v1/traces
3434
logsEndpoint: https://logfire-api.pydantic.dev/v1/logs
3535

36+
tailscale:
37+
authkey: ''
38+
tailnet: tail9d164.ts.net
39+
3640
instrumentation:
3741
otlpEndpoint: http://tracing-collector:4317
3842
enabled: false

‎chart/values/dev.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,7 @@ openai:
88
apiKey: AgA3XsyrGrYYGsouyAD58P5UnEo9E1B7kOcUVIhy/gX5xTD553Gvu0v8h2Evt9cvYqZZzBkLrUT85FGN9cvkaglgsBYkpCWgpgCE76U177vZXPI3788CfxFUmbMEDDsmdhmCztq3iL+JvudvScCWI4VOsOaYRGORanQRYTX8URE4FAXA0Kwi3KUACd3dAhaLf83EM3JKzBS9i/TPOR9XXrBjQSVqXazaMr/q6YuXgZHJV1lSL33mG12CVxtQJhf8NGAqRPAB1QrdNyXc1qqXRDFsUqn4RZe8yAhFjfIcJBNHrINp/e+Wp3JFg2Z2wcl04/hrojTGQ9xO7stdt/SsdA9jrA8H3O5ELyah/52c6otMpfPPu9C+/JOQeWWL7MRX4HpHkjW2yuyIiXL8ZNNTjgzIXvORDADF3lgDkNjoi4lPYaBqt2JH5cF5c/r8gwg5xDDZJo/p0JIbkxSxH0HzRb6zYV7UQOAe+CWFdT3GZybgUvRs6MFyqq9pFl3EAvwdbTZswXvg4J7oYN8YOJP/FB9VAx3dcxIGoVuW0km2fPJ8xVxxRQ5N4z02a9f7rIu211gisi3PBRSNNFJuOrBW5ynH4OucxX8auqXN3EmLTCtVAOpHih0ijnJYQlLKAUtuAlMxsA38SKJ+ScDYeMXWMgM0E133zYE6q6b+os4lW4OL05O4W3gCHHbRNbtoUl4UqZ2UWmm4pq4P/ilRWzxCfEcqtOQr/fKIo/TdcST+x0FC1rblS4RlJr07W2AsC82Evn1YcQMWtZN+KEmD3wuBWHLmpZ7XMsBCb0wQpGPDm6Am6uQYH49zeQz4WN6CF1cVcf117lzlxQCA4SaWOpvEgmu9VJyOY9OF+k4MSgOaa0w94vfsqRZeCje2Ssew7608/zHejwy+sA0WjSJXvwIgkGVIr3FRoKdcsg==
99
logfire:
1010
token: AgBgcK/ZuWC78Ws1QHkotvvSqK4KOXSP9cuyZOH+Y7j7Ae8+/PAuFzIge/jRMFoCPzg+9oi15k7diiUV23N52Q5XHewkSjWU58DUEextchpB+yo9U/dU9MN0W/Nih02ij1cct10IDJ5tbmojETC9SUkvfXw0YyVl1fd4MhNVHfIvTO8F8v2ke12beNUuOrmJtPwFw+BWWlvNezp5QdKlMJFyo6C5NaHMrXYSOrQcgGzVuopCLZsIAPVfnAkoPHvSKHsra4ff+EtsqK68bacNChqF/nxq/cUGfSWV0Q+7a4zoGFadXqOtbLluIFAV01cliSsH4Ady3c3MK2W8UD5e8l9uYEZjpBmsA8C5Z8RfHECRUd7Abys3HW0ReXe/g0mQJZb+8Zy3z/gWcNkYqUXyFnKi8QTXzK2q8Msqi/iFyuH7NQF2Up/Iqc6XpxPn7tbNVLHphW6eynakmJLHhSIBn6/klRRN5weXIZVZ8hU8WNKeQOhLfWzKkRhifXsFSJ6GeSel0yLHhCWoaOskw2KNm4CqxaDKsQcsYAneVn15G7fNvkZ7w9Y2cyylVFrG4rsFPtNbKLDv4KArfACw9uI79AwAvBZD3wPefIYByFtkR6bEXUAVqzX8+JR2wZBzCY1tt6gW3ufnDhI66McW/bz22PIPgjxyhM/CbCGCZHsDWWTGbg5q1rMbTwNZdNGsiePHSGxcwhK+GJptTyJ3bp1InVppDvMqee5OenwdnMDgJCH03sU0BwK9uM/AuxRQ4CSeknr4mUaPr5Pc
11+
tailscale:
12+
authkey: AgBUvW6t3VLq12NBC2FrmNE00HmTj8enoJBk/ePvHj7FmTqg2RbAFSwHEoCQo74kLKV/fT4ONYhdOf8OY9xcRogNYCfxkqwMOYQ0Udsk6hQlBmz63GQDkrxk2a41az+iT8tHywLSVVdBGpahgLSS+O0r0V/1gOo7tyQJyfWmMVAg6Krey8ROlVrdP/uT+6Sqd5UddpqIwpEmJS4AFREdkPTx5ihBM8oMv5UnHKvJaUtuZtDWnbM6KpxAFX7Eis1E0B/5LnjI2nPhRR7jZ4Uz2z9WWaXubnk7EQ52sojvQWZ0Kdq4v7UAMUnrAbicx0cQcD9GCvzzy5GORUHK7DYm+v6J8SOPWKJnrDkHWGj39lqiOx6LW220CmTGIjsyPl7Qhly8JQRecQo3GdCe4Hv0mIGKQZwF08XzTc90bto98hh41MygKqh+cbpLaSYXzJzaHnurIBvXcVXMkrGw2dV+YKtYjIt0mV9oMylz00gVnR67OuO7xz5bTSH4EKZq1cTnwZxlH30ssZ7zEpIboKoVabV47CBYRPU2YDugRgtb240Ll0M7k4K3cOGSq4JhsbB1T/RPWOix5KLzSnC+cdIJMl0S4kmc2P1pzxJ2TjxBZxD41D/WsszB9gdfPu8VolHRAQ6/juFttUfi3+HSwGU0yb3Zdx0qLOf7JTsDPmHR8Jo1xLGwDeQ9o2wsI4z/5upL/imvHk/ZGY3CSE5O0Tm72t18G9B+grnjcjC89chH5to2W880PF8xDgprIfS/aCPdihmCjATbfPBv5orgbkrjuA==
1113
instrumentation:
1214
enabled: true

0 commit comments

Comments
 (0)