apiVersion: v1
kind: Namespace
metadata:
  name: tailscale
---
apiVersion: v1
kind: Secret
metadata:
  name: operator-oauth
  namespace: tailscale
  annotations:
    kube-1password: xwj5xtmakuzeujeqzqd3mp67xy
    kube-1password/vault: Kubernetes
    kube-1password/secret-text-parse: "true"
type: Opaque
---
apiVersion: apps/v1
kind: Deployment
metadata:
    name: tailscale-operator
    namespace: tailscale
spec:
    replicas: 1
    selector:
        matchLabels:
            app: tailscale-operator
    strategy:
        type: Recreate
    template:
        metadata:
            labels:
                app: tailscale-operator
        spec:
            containers:
                - env:
                    - name: OPERATOR_HOSTNAME
                      value: tailscale-operator
                      valueFrom:
                        fieldRef:
                          fieldPath: metadata.labels['app.kubernetes.io/instance']
                    - name: OPERATOR_SECRET
                      value: operator
                    - name: OPERATOR_LOGGING
                      value: info
                    - name: OPERATOR_NAMESPACE
                      valueFrom:
                        fieldRef:
                            fieldPath: metadata.namespace
                    - name: ENABLE_CONNECTOR
                      value: "false"
                    - name: CLIENT_ID_FILE
                      value: /oauth/client_id
                    - name: CLIENT_SECRET_FILE
                      value: /oauth/client_secret
                    - name: PROXY_IMAGE
                      value: tailscale/tailscale:unstable
                    - name: PROXY_TAGS
                      value: tag:k8s
                    - name: APISERVER_PROXY
                      value: "false"
                    - name: PROXY_FIREWALL_MODE
                      value: auto
                  image: tailscale/k8s-operator:unstable
                  imagePullPolicy: Always
                  name: operator
                  volumeMounts:
                    - mountPath: /oauth
                      name: oauth
                      readOnly: true
            serviceAccountName: operator
            volumes:
                - name: oauth
                  secret:
                    secretName: operator-oauth