Old school kubernetes ingress controller with Tailscale + nginx, deployed with Flux

nginx-tailscale.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: nginx-tailscale
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: nginx-tailscale
  namespace: nginx-tailscale
spec:
  interval: 30m
  chartRef:
    kind: HelmChart
    name: ingress-nginx
    namespace: flux-infra
  values:
    fullnameOverride: nginx-tailscale
    controller:
      kind: DaemonSet
      service:
        enabled: false
      admissionWebhooks:
        enabled: false
      ingressClass: null
      ingressClassResource:
        name: tailscale
        controllerValue: k8s.io/ingress-nginx/tailscale
      extraArgs:
        publish-status-address: 100.1.2.3,fd7a:115c::123
        update-status-on-shutdown: false
      config:
        log-format-escape-json: true
        log-format-upstream: '{"time": "$time_iso8601", "remote_addr": "$proxy_protocol_addr", "x_forwarded_for": "$proxy_add_x_forwarded_for", "request_id": "$req_id", "remote_user": "$remote_user", "bytes_sent": $bytes_sent, "request_time": $request_time, "status": $status, "vhost": "$host", "request_proto": "$server_protocol", "path": "$uri", "request_query": "$args", "request_length": $request_length, "duration": $request_time,"method": "$request_method", "http_referrer": "$http_referer", "http_user_agent": "$http_user_agent", "namespace": "$namespace", "ingress_name": "$ingress_name", "service_name": "$service_name", "service_port": "$service_port" }'
        # OpenTelemetry!
        enable-opentelemetry: true
        opentelemetry-trust-incoming-span: true
        opentelemetry-operation-name: "$request_method $host"
        otel-sampler: "AlwaysOn" # apparently the default is off??
        otel-schedule-delay-millis: 5000
        otel-max-export-batch-size: 512
        otel-service-name: nginx-tailscale
        otlp-collector-host: opentelemetry-agents-grpc.telemetry.svc
        otlp-collector-port: 80
      opentelemetry:
        enabled: true
      resources:
        requests:
          cpu: 10m
          memory: 90Mi
        limits:
          cpu: 250m
          memory: 200Mi
      nodeSelector:
        kubernetes.io/service-tier: datacenter
  postRenderers:
  - kustomize:
      patches:
      - target:
          group: apps
          version: v1
          kind: DaemonSet
          name: nginx-tailscale-controller
        patch: |
          apiVersion: apps/v1
          kind: DaemonSet
          metadata:
            name: nginx-tailscale-controller
          spec:
            revisionHistoryLimit: 2
            template:
              spec:
                terminationGracePeriodSeconds: 10
                containers:
                - name: tailscale
                  image: tailscale
                  env:
                  - name: TS_KUBE_SECRET
                    value: tailscale-state
                  - name: POD_NAME
                    valueFrom:
                      fieldRef:
                        fieldPath: metadata.name
                  - name: POD_UID
                    valueFrom:
                      fieldRef:
                        fieldPath: metadata.uid
                  resources:
                    limits:
                      cpu: 500m
                      memory: 256Mi
                    requests:
                      cpu: 25m
                      memory: 75Mi
                  securityContext:
                    capabilities:
                      add:
                      - NET_ADMIN
      images:
      - name: tailscale
        # https://hub.docker.com/r/tailscale/tailscale/tags?page=&page_size=&ordering=&name=v1
        newName: tailscale/tailscale # {"$imagepolicy": "flux-apps:tailscale:name"}
        newTag: v1.92.5 # {"$imagepolicy": "flux-apps:tailscale:tag"}
        digest: 'sha256:4a0aaacee6f28e724c1f80c986e5776c9c979d8f7e19274c2cae2d495cc8d625' # {"$imagepolicy": "flux-apps:tailscale:digest"}
---
# RBAC for the tailscale sidecar
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: tailscale-state-access
  namespace: nginx-tailscale
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
- apiGroups:
  - ""
  resourceNames:
  - tailscale-state
  resources:
  - secrets
  verbs:
  - get
  - update
  - patch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - get
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tailscale-state-access
  namespace: nginx-tailscale
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: tailscale-state-access
subjects:
- kind: ServiceAccount
  name: nginx-tailscale
---
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageRepository
metadata:
  name: tailscale
  namespace: flux-apps
spec:
  image: tailscale/tailscale
  interval: 12h
---
# Automatic updates for the tailscale sidecar
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata:
  name: tailscale
  namespace: flux-apps
spec:
  imageRepositoryRef:
    name: tailscale
  digestReflectionPolicy: IfNotPresent
  filterTags:
    pattern: '^v(?P<semver>[.0-9]+)$'
    extract: '$semver'
  policy:
    semver:
      range: '^1'