Compare commits

..

2 commits

Author SHA1 Message Date
7581b61cbf C0: tailscale-operator manifests to [main] image tags
Post-squash-merge rebuild of PR #374's containers from main (runs
585/586); same v1.94.2 content, tags now traceable to d03ed337.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-09 17:55:52 -07:00
d03ed337a9 Localize the Tailscale operator stack (k8s-operator + indri ProxyClass) (#374)
Weekly non-local-container task: localize the Tailscale operator stack on **both clusters**.

## What

- **`containers/tailscale-operator/`** (new) — builds `cmd/k8s-operator` v1.94.2 from the forge mirror, mirroring upstream's mkctr recipe (`/usr/local/bin/operator`, `ts_kube,ts_package_container` go tags, version stamps). `container.py` (dagger) for indri/arm64; `default.nix` for ringtail/amd64.
- **`containers/tailscale/container.py`** (new) — dagger/arm64 build of the proxy image (containerboot), mirroring the upstream Dockerfile (iptables-legacy symlinks, `/tailscale/run.sh` compat). Ringtail already consumes the existing nix build; this completes parity for indri.
- **Version pinned at v1.94.2** (same as currently deployed) — this PR is a pure supply-chain swap, no version change. v1.96.x is avoided deliberately (MagicDNS-in-containers regression).
- Docs-first: tailscale-operator card gains **Local Images** and **Rollout Safety** sections.

## Rollout plan (after image builds)

1. Manifest commit: per-overlay `images:` override for the operator + ProxyClass strategic-merge patch on indri (kustomize `images:` can't touch CR fields).
2. `argocd app set tailscale-operator --revision <branch> && argocd app sync` — indri first, verify, then ringtail.
3. **Shadow-device safety**: device identity lives in the tailscale state Secrets; an image swap re-uses existing node keys, so no `-1` clones. State Secrets are not touched. Post-sync verification: pod health, device names unchanged, `mise run services-check`.

## Follow-ups (not this PR)

- `dnsconfig` nameserver image (`tailscale/k8s-nameserver:stable`) still upstream.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #374
2026-06-09 17:45:23 -07:00
3 changed files with 4 additions and 4 deletions

View file

@ -15,7 +15,7 @@ resources:
images:
- name: docker.io/tailscale/k8s-operator
newName: registry.ops.eblu.me/blumeops/tailscale-operator
newTag: v1.94.2-ac40a18-nix
newTag: v1.94.2-d03ed33-nix
# Rewrite the proxyclass image to our local nix-built mirror (indri's overlay
# carries the equivalent dagger/arm64 patch). A strategic merge patch is used

View file

@ -21,7 +21,7 @@ resources:
images:
- name: docker.io/tailscale/k8s-operator
newName: registry.ops.eblu.me/blumeops/tailscale-operator
newTag: v1.94.2-ac40a18
newTag: v1.94.2-d03ed33
# Rewrite the proxyclass image to the local mirror. A strategic merge patch
# is used instead of kustomize's `images:` directive because that directive

View file

@ -6,6 +6,6 @@ spec:
statefulSet:
pod:
tailscaleContainer:
image: registry.ops.eblu.me/blumeops/tailscale:v1.94.2-ac40a18
image: registry.ops.eblu.me/blumeops/tailscale:v1.94.2-d03ed33
tailscaleInitContainer:
image: registry.ops.eblu.me/blumeops/tailscale:v1.94.2-ac40a18
image: registry.ops.eblu.me/blumeops/tailscale:v1.94.2-d03ed33