apiVersion: v1
kind: ServiceAccount
metadata:
    name: operator
    namespace: tailscale
---
apiVersion: v1
kind: ServiceAccount
metadata:
    name: proxies
    namespace: tailscale
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
    name: tailscale-operator
rules:
    - apiGroups:
        - ""
      resources:
        - events
        - services
        - services/status
      verbs:
        - '*'
    - apiGroups:
        - networking.k8s.io
      resources:
        - ingresses
        - ingresses/status
      verbs:
        - '*'
    - apiGroups:
        - tailscale.com
      resources:
        - connectors
        - connectors/status
      verbs:
        - get
        - list
        - watch
        - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
    name: tailscale-operator
roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: tailscale-operator
subjects:
    - kind: ServiceAccount
      name: operator
      namespace: tailscale
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
    name: operator
    namespace: tailscale
rules:
    - apiGroups:
        - ""
      resources:
        - secrets
      verbs:
        - '*'
    - apiGroups:
        - apps
      resources:
        - statefulsets
      verbs:
        - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
    name: proxies
    namespace: tailscale
rules:
    - apiGroups:
        - ""
      resources:
        - secrets
      verbs:
        - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
    name: operator
    namespace: tailscale
roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: operator
subjects:
    - kind: ServiceAccount
      name: operator
      namespace: tailscale
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
    name: proxies
    namespace: tailscale
roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: proxies
subjects:
    - kind: ServiceAccount
      name: proxies
      namespace: tailscale
---