Erich Blume
d03ed337a9
Weekly non-local-container task: localize the Tailscale operator stack on **both clusters**. ## What - **`containers/tailscale-operator/`** (new) — builds `cmd/k8s-operator` v1.94.2 from the forge mirror, mirroring upstream's mkctr recipe (`/usr/local/bin/operator`, `ts_kube,ts_package_container` go tags, version stamps). `container.py` (dagger) for indri/arm64; `default.nix` for ringtail/amd64. - **`containers/tailscale/container.py`** (new) — dagger/arm64 build of the proxy image (containerboot), mirroring the upstream Dockerfile (iptables-legacy symlinks, `/tailscale/run.sh` compat). Ringtail already consumes the existing nix build; this completes parity for indri. - **Version pinned at v1.94.2** (same as currently deployed) — this PR is a pure supply-chain swap, no version change. v1.96.x is avoided deliberately (MagicDNS-in-containers regression). - Docs-first: tailscale-operator card gains **Local Images** and **Rollout Safety** sections. ## Rollout plan (after image builds) 1. Manifest commit: per-overlay `images:` override for the operator + ProxyClass strategic-merge patch on indri (kustomize `images:` can't touch CR fields). 2. `argocd app set tailscale-operator --revision <branch> && argocd app sync` — indri first, verify, then ringtail. 3. **Shadow-device safety**: device identity lives in the tailscale state Secrets; an image swap re-uses existing node keys, so no `-1` clones. State Secrets are not touched. Post-sync verification: pod health, device names unchanged, `mise run services-check`. ## Follow-ups (not this PR) - `dnsconfig` nameserver image (`tailscale/k8s-nameserver:stable`) still upstream. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #374
67 lines
1.7 KiB
Nix
67 lines
1.7 KiB
Nix
# Nix-built tailscale k8s-operator for ringtail's tailscale-operator app.
|
|
# Builds cmd/k8s-operator v1.94.2 from the forge mirror, mirroring upstream's
|
|
# build_docker.sh mkctr recipe (binary at /usr/local/bin/operator, ts_kube +
|
|
# ts_package_container go tags). Built on the ringtail nix-container-builder.
|
|
{ pkgs ? import <nixpkgs> { } }:
|
|
|
|
let
|
|
version = "1.94.2";
|
|
|
|
src = pkgs.fetchgit {
|
|
url = "https://forge.ops.eblu.me/mirrors/tailscale.git";
|
|
rev = "v${version}";
|
|
hash = "sha256-qjWVB8xWVgIVUgrf27F6hwiFIE+4ERXWeHv26ugg/x4=";
|
|
};
|
|
|
|
operator = pkgs.buildGoModule {
|
|
inherit src version;
|
|
pname = "tailscale-operator";
|
|
vendorHash = "sha256-WeMTOkERj4hvdg4yPaZ1gRgKnhRIBXX55kUVbX/k/xM=";
|
|
|
|
subPackages = [ "cmd/k8s-operator" ];
|
|
|
|
tags = [
|
|
"ts_kube"
|
|
"ts_package_container"
|
|
];
|
|
|
|
ldflags = [
|
|
"-s"
|
|
"-w"
|
|
"-X tailscale.com/version.longStamp=${version}"
|
|
"-X tailscale.com/version.shortStamp=${version}"
|
|
];
|
|
|
|
doCheck = false;
|
|
|
|
meta = with pkgs.lib; {
|
|
description = "Tailscale operator for Kubernetes";
|
|
homepage = "https://tailscale.com";
|
|
license = licenses.bsd3;
|
|
};
|
|
};
|
|
in
|
|
|
|
pkgs.dockerTools.buildLayeredImage {
|
|
name = "blumeops/tailscale-operator";
|
|
tag = "v${version}";
|
|
|
|
contents = [
|
|
operator
|
|
pkgs.cacert
|
|
];
|
|
|
|
# buildGoModule names the binary after the package dir (k8s-operator);
|
|
# upstream's image expects /usr/local/bin/operator.
|
|
extraCommands = ''
|
|
mkdir -p usr/local/bin
|
|
ln -s /bin/k8s-operator usr/local/bin/operator
|
|
'';
|
|
|
|
config = {
|
|
Entrypoint = [ "/usr/local/bin/operator" ];
|
|
Env = [
|
|
"SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
|
|
];
|
|
};
|
|
}
|