fix(tailscale): adds tun device and runs as root by default (#3519)

charts/incubator/tailscale/Chart.yaml

@@ -20,7 +20,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/tailscale
   - https://hub.docker.com/r/tailscale/tailscale
   - https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh
-version: 0.0.3
+version: 0.0.4
 annotations:
   truecharts.org/catagories: |
     - network

charts/incubator/tailscale/docs/installation_notes.md

@@ -1,19 +0,0 @@
-# Installation Notes
-
-If you want to use `Tailscale` in **non**-user mode, you have to run this as `root` user.
-You can do this by editing the following
-
-Under `Tailscale Configuration`
-
-- Uncheck `Userspace`
-
-Under `Security and Permissions`
-
-- Check `Show Advanced Security Settings`
-  - Uncheck `ReadOnly Root Filesystem`
-  - Uncheck `runAsNonRoot`
-
-Under `Pod Security Context`
-
-- runAsUser: `0`
-- runAsGroup: `0`

charts/incubator/tailscale/questions.yaml

@@ -58,6 +58,11 @@ questions:
           schema:
             type: string
             default: ""
+        - variable: daemon_extra_args
+          label: "Tailscale Daemon Extra Args"
+          schema:
+            type: string
+            default: ""
 # Include{containerConfig}
 # Include{serviceRoot}
         - variable: main
@@ -126,7 +131,7 @@ questions:
                 label: "ReadOnly Root Filesystem"
                 schema:
                   type: boolean
-                  default: true
+                  default: false
               - variable: allowPrivilegeEscalation
                 label: "Allow Privilege Escalation"
                 schema:
@@ -136,7 +141,7 @@ questions:
                 label: "runAsNonRoot"
                 schema:
                   type: boolean
-                  default: true
+                  default: false
 # Include{securityContextAdvanced}
 # Include{podSecurityContextRoot}
         - variable: runAsUser
@@ -144,13 +149,13 @@ questions:
           description: "The UserID of the user running the application"
           schema:
             type: int
-            default: 568
+            default: 0
         - variable: runAsGroup
           label: "runAsGroup"
           description: "The groupID this App of the user running the application"
           schema:
             type: int
-            default: 568
+            default: 0
         - variable: fsGroup
           label: "fsGroup"
           description: "The group that should own ALL storage."

charts/incubator/tailscale/templates/_configmap.tpl

@@ -27,4 +27,7 @@ data:
   {{- with .Values.tailscale.extra_args }}
   TS_EXTRA_ARGS: {{ . | quote }}
   {{- end }}
+  {{- with .Values.tailscale.daemon_extra_args }}
+  TS_TAILSCALED_EXTRA_ARGS: {{ . | quote }}
+  {{- end }}
 {{- end }}

charts/incubator/tailscale/templates/_privelegednet.tpl

@@ -1,15 +0,0 @@
-{{- define "tailscale.tun" -}}
----
-enabled: true
-type: hostPath
-hostPath: /dev/net/tun
-mountPath: /dev/net/tun
-hostPathType: ""
-readOnly: false
-{{- end }}
-
-{{- define "tailscale.caps" -}}
----
-add:
-  - NET_ADMIN
-{{- end }}

charts/incubator/tailscale/templates/common.yaml

@@ -7,10 +7,5 @@
 {{/* Render config */}}
 {{- include "tailscale.config" . }}
 
-{{- if not .Values.tailscale.userspace }}
-{{- $_ := set .Values.persistence "tun" (include "tailscale.tun" . | fromYaml) -}}
-{{- $_ := set .Values.securityContext "capabilities" (include "tailscale.caps" . | fromYaml) -}}
-{{- end }}
-
 {{/* Render the templates */}}
 {{ include "tc.common.loader.apply" . }}

charts/incubator/tailscale/values.yaml

@@ -7,14 +7,16 @@ command: ["ash", "/tailscale/run.sh"]
 
 tty: true
 
-# Only un-comment this if you are going to have `userspace: false`
-# securityContext:
-#   readOnlyRootFilesystem: false
-#   runAsNonRoot: false
+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+  capabilities:
+    add:
+      - NET_ADMIN
 
-# podSecurityContext:
-#   runAsUser: 0
-#   runAsGroup: 0
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
 
 serviceAccount:
   main:
@@ -52,6 +54,7 @@ tailscale:
   dest_ip: ""
   sock5_server: ""
   extra_args: ""
+  daemon_extra_args: ""
 
 probes:
   liveness:
@@ -72,6 +75,13 @@ persistence:
   config:
     enabled: true
     mountPath: "/var/lib"
+  tun:
+    enabled: true
+    type: hostPath
+    hostPath: /dev/net/tun
+    mountPath: /dev/net/tun
+    hostPathType: ""
+    readOnly: false
 
 portal:
   enabled: false