update

Author: ewdurbin

containers/tailscale-operator-manager/examples/deployment.yml

@@ -20,25 +20,19 @@ spec:
     spec:
       serviceAccountName: cabotage-tailscale-operator-manager-account
       initContainers:
-        - name: cabotage-enroller
-          image: cabotage/sidecar:4
+        - name: cabotage-sidecar
+          image: cabotage/sidecar:4.1
+          restartPolicy: Always
           args:
-            - "kube-login"
+            - "kube-login-and-maintain"
             - "--vault-ca-file=/var/run/secrets/cabotage.io/ca.crt"
             - "--vault-auth-kubernetes-role=cabotage-tailscale-operator-manager"
           volumeMounts:
             - name: vault-token
               mountPath: /var/run/secrets/vault
       containers:
-        - name: cabotage-sidecar
-          image: cabotage/sidecar:4
-          args:
-            - "maintain"
-          volumeMounts:
-            - name: vault-token
-              mountPath: /var/run/secrets/vault
         - name: tailscale-operator-manager
-          image: cabotage/tailscale-operator-manager:1
+          image: ghcr.io/cabotage/containers/tailscale-operator-manager:latest
           imagePullPolicy: Always
           args:
             - "--verbose"

containers/tailscale-operator-manager/examples/rbac.yaml

@@ -19,7 +19,7 @@ rules:
   # Framework: runtime observation of namespaces & CRDs (addition/deletion).
   - apiGroups: [apiextensions.k8s.io]
     resources: [customresourcedefinitions]
-    verbs: [list, watch]
+    verbs: [get, list, watch]
   - apiGroups: [""]
     resources: [namespaces]
     verbs: [list, watch]
@@ -31,39 +31,38 @@ rules:
 
   # Application: watch the CabotageTailscaleOperatorConfig CRD cluster-wide.
   - apiGroups: [cabotage.io]
-    resources: [cabotagetailscaleoperatorconfigs]
+    resources: [cabotagetailscaleoperatorconfigs, cabotagetailscaleoperatorconfigs/status]
     verbs: [list, watch, patch, get]
 
   # Manage K8s resources in org namespaces for the Tailscale operator.
   - apiGroups: [""]
     resources: [secrets, serviceaccounts]
-    verbs: [get, list, create, update, patch, delete]
+    verbs: [get, list, watch, create, update, patch, delete]
   - apiGroups: [apps]
     resources: [deployments]
-    verbs: [get, list, create, update, patch, delete]
+    verbs: [get, list, watch, create, update, patch, delete]
   - apiGroups: [rbac.authorization.k8s.io]
     resources: [roles, rolebindings]
-    verbs: [get, list, create, update, patch, delete]
+    verbs: [get, list, watch, create, update, patch, delete]
 
   # Manage ClusterRoleBinding subjects (add/remove operator SAs).
   - apiGroups: [rbac.authorization.k8s.io]
     resources: [clusterrolebindings]
     verbs: [get, list, update, patch]
 
-  # Must hold all permissions from the tailscale-operator ClusterRole
-  # (RBAC escalation prevention when modifying its ClusterRoleBinding),
-  # plus all permissions from the namespace-scoped operator Role.
+  # Delegated permissions — the manager must hold every permission it grants
+  # via the tailscale-operator ClusterRole (K8s RBAC escalation prevention).
   - apiGroups: [""]
     resources: [nodes]
     verbs: [get, list, watch]
   - apiGroups: [""]
-    resources: [configmaps, events, pods, services, services/status]
+    resources: [configmaps, events, pods]
+    verbs: [get, list, watch, create, update, patch, delete]
+  - apiGroups: [""]
+    resources: [services, services/status]
     verbs: [get, list, watch, create, update, patch, delete, deletecollection]
-  - apiGroups: [apiextensions.k8s.io]
-    resources: [customresourcedefinitions]
-    verbs: [get, list, watch]
   - apiGroups: [apps]
-    resources: [statefulsets, deployments]
+    resources: [statefulsets]
     verbs: [get, list, watch, create, update, patch, delete]
   - apiGroups: [coordination.k8s.io]
     resources: [leases]
@@ -72,14 +71,8 @@ rules:
     resources: [endpointslices]
     verbs: [get, list, watch]
   - apiGroups: [networking.k8s.io]
-    resources: [ingresses, ingresses/status]
-    verbs: [get, list, watch, create, update, patch, delete, deletecollection]
-  - apiGroups: [networking.k8s.io]
-    resources: [ingressclasses]
+    resources: [ingresses, ingresses/status, ingressclasses]
     verbs: [get, list, watch, update, patch]
-  - apiGroups: [rbac.authorization.k8s.io]
-    resources: [roles, rolebindings]
-    verbs: [get, list, watch, create, update, patch, delete]
   - apiGroups: [tailscale.com]
     resources: ["*"]
     verbs: [get, list, watch, create, update, patch, delete]

containers/tailscale-operator-manager/operator.py

@@ -279,12 +279,12 @@ def _operator_role_rules():
         kubernetes.client.V1PolicyRule(
             api_groups=[""],
             resources=["secrets", "serviceaccounts", "configmaps", "events"],
-            verbs=["get", "list", "watch", "create", "update", "patch", "delete"],
+            verbs=["get", "list", "watch", "create", "update", "patch", "delete", "deletecollection"],
         ),
         kubernetes.client.V1PolicyRule(
             api_groups=[""],
             resources=["services", "services/status"],
-            verbs=["get", "list", "watch", "update", "patch"],
+            verbs=["get", "list", "watch", "create", "update", "patch", "delete", "deletecollection"],
         ),
         kubernetes.client.V1PolicyRule(
             api_groups=[""],
@@ -294,7 +294,7 @@ def _operator_role_rules():
         kubernetes.client.V1PolicyRule(
             api_groups=["apps"],
             resources=["statefulsets", "deployments"],
-            verbs=["get", "list", "watch", "create", "update", "patch", "delete"],
+            verbs=["get", "list", "watch", "create", "update", "patch", "delete", "deletecollection"],
         ),
         kubernetes.client.V1PolicyRule(
             api_groups=["networking.k8s.io"],