Erich Blume
ac40a18f3f
Docs-first for C1: tailscale-operator card gains Local Images and Rollout Safety sections (device identity lives in state Secrets; image swaps don't re-register devices). New containers/tailscale-operator (container.py for indri/arm64, default.nix for ringtail/amd64) builds cmd/k8s-operator from the forge mirror, mirroring upstream's mkctr recipe. containers/tailscale gains a container.py so indri's ProxyClass can use a local arm64 proxy image (ringtail already consumes the nix build). Manifest updates follow once images are built and tagged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
53 lines
1.6 KiB
Python
53 lines
1.6 KiB
Python
"""Tailscale Kubernetes operator — native Dagger build.
|
|
|
|
Single Go binary (cmd/k8s-operator) from the forge mirror, mirroring
|
|
upstream's build_docker.sh mkctr recipe: binary at /usr/local/bin/operator,
|
|
go tags ts_kube + ts_package_container, version stamps in ldflags.
|
|
|
|
Consumed by the tailscale-operator app on indri's minikube (arm64); the
|
|
ringtail app uses the -nix tag from default.nix instead.
|
|
"""
|
|
|
|
import dagger
|
|
|
|
from blumeops.containers import (
|
|
alpine_runtime,
|
|
clone_from_forge,
|
|
go_build,
|
|
oci_labels,
|
|
)
|
|
|
|
VERSION = "v1.94.2"
|
|
|
|
|
|
async def build(src: dagger.Directory) -> dagger.Container:
|
|
source = clone_from_forge("tailscale", VERSION)
|
|
semver = VERSION.removeprefix("v")
|
|
|
|
builder = go_build(
|
|
source,
|
|
"/out/operator",
|
|
cmd_path="./cmd/k8s-operator",
|
|
tags="ts_kube,ts_package_container",
|
|
ldflags=(
|
|
"-w -s"
|
|
f" -X tailscale.com/version.longStamp={semver}"
|
|
f" -X tailscale.com/version.shortStamp={semver}"
|
|
),
|
|
)
|
|
|
|
# Upstream runs the operator as root on a minimal base; only CA certs
|
|
# are needed at runtime (operator talks to the k8s API and Tailscale
|
|
# control plane over HTTPS).
|
|
runtime = alpine_runtime(extra_apk=["ca-certificates"], create_user=False)
|
|
runtime = oci_labels(
|
|
runtime,
|
|
title="Tailscale Kubernetes Operator",
|
|
description="Tailscale operator for Kubernetes Ingress/egress proxies",
|
|
version=VERSION,
|
|
)
|
|
return runtime.with_file(
|
|
"/usr/local/bin/operator",
|
|
builder.file("/out/operator"),
|
|
permissions=0o555,
|
|
).with_entrypoint(["/usr/local/bin/operator"])
|