apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: tailscale
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["create"]
  - apiGroups: [""]
    resourceNames: ["tailscale"]
    resources: ["secrets"]
    verbs: ["get", "update"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tailscale
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tailscale
subjects:
  - kind: ServiceAccount
    name: tailscale
roleRef:
  kind: Role
  name: tailscale
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: subnet-router
  namespace: kube-system
spec:
  minReadySeconds: 15
  replicas: 1
  selector:
    matchLabels:
      app: tailscale-subnet-router
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: tailscale-subnet-router
    spec:
      serviceAccountName: tailscale
      containers:
        - name: tailscale
          imagePullPolicy: Always
          image: ghcr.io/tailscale/tailscale:v1.42.0
          env:
            - name: TS_KUBE_SECRET
              value: tailscale
            - name: TS_USERSPACE
              value: "true"
            - name: TS_AUTH_KEY
              valueFrom:
                secretKeyRef:
                  name: tailscale-auth
                  key: TS_AUTH_KEY
                  optional: true
            - name: TS_ROUTES
              value: "10.43.0.0/16"
            - name: TS_EXTRA_ARGS
              value: "--login-server https://headscale.tbrnt.ch"
          securityContext:
            runAsUser: 1000
            runAsGroup: 1000
