tighten up the tailscale-operator-manager

- remove unnecessary CRD props
- validate CRD values
- remove dead code
- don't swallow errors

Author: ewdurbin

containers/tailscale-operator-manager/Dockerfile

@@ -4,7 +4,6 @@ USER root
 COPY requirements.txt /opt/cabotage/requirements.txt
 
 RUN pip --no-cache-dir --disable-pip-version-check install -r /opt/cabotage/requirements.txt
-USER nobody
 
 COPY operator.py /opt/cabotage/operator.py
 ENTRYPOINT ["kopf", "run", "/opt/cabotage/operator.py", "--all-namespaces"]

containers/tailscale-operator-manager/crds/crd.yml

@@ -20,9 +20,6 @@ spec:
         - name: State
           type: string
           jsonPath: .status.reconcile_operator.state
-        - name: Version
-          type: string
-          jsonPath: .status.reconcile_operator.operatorVersion
         - name: Age
           type: date
           jsonPath: .metadata.creationTimestamp
@@ -36,27 +33,26 @@ spec:
               type: object
               required:
                 - clientId
-                - operatorImage
                 - organizationSlug
               properties:
                 clientId:
                   type: string
+                  maxLength: 255
                   description: >
                     Tailscale OIDC federated identity client ID.
                     Cabotage mints JWTs signed by its OIDC issuer and
                     writes them to a K8s Secret for the operator to use.
-                operatorImage:
-                  type: string
-                  description: >
-                    Full image reference for the Tailscale operator
-                    (e.g. ghcr.io/tailscale/k8s-operator:v1.94.2).
                 defaultTags:
                   type: string
+                  maxLength: 512
+                  pattern: "^(tag:[a-z0-9-]+(,\\s*tag:[a-z0-9-]+)*)?$"
                   description: >
                     Default ACL tags for operator-created nodes
-                    (e.g. tag:k8s).
+                    (e.g. tag:cabotage).
                 organizationSlug:
                   type: string
+                  maxLength: 63
+                  pattern: "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$"
                   description: >
                     Cabotage organization slug for labeling.
             status:

containers/tailscale-operator-manager/operator.py

@@ -45,30 +45,6 @@ def startup_fn(logger, memo, settings, **kwargs):
 # ---------------------------------------------------------------------------
 
 
-def _ensure_resource(read_fn, create_fn, replace_fn, *args, **kwargs):
-    """Generic create-or-update pattern."""
-    resource = kwargs.pop("resource")
-    try:
-        read_fn(*args)
-        replace_fn(*args, resource)
-    except ApiException as exc:
-        if exc.status == 404:
-            # For create, the name is part of the resource body, not a positional arg
-            # create_fn signature varies: (namespace, body) or just (body)
-            create_fn(resource)
-        else:
-            raise
-
-
-def _delete_if_exists(fn, *args, logger=None):
-    try:
-        fn(*args)
-    except ApiException as exc:
-        if exc.status != 404:
-            if logger:
-                logger.warning(f"Failed to delete {args}: {exc}")
-
-
 TAILNET_API = {
     "group": "tailscale.com",
     "version": "v1alpha1",
@@ -92,11 +68,27 @@ def _ensure_tailnet(custom_api, crd_name, secret_name, labels, logger):
         },
     }
     try:
-        custom_api.get_cluster_custom_object(
+        existing = custom_api.get_cluster_custom_object(
             TAILNET_API["group"], TAILNET_API["version"],
             TAILNET_API["plural"], crd_name,
         )
-        logger.info(f"Tailnet {crd_name} already exists")
+        existing_secret = existing.get("spec", {}).get("credentials", {}).get("secretName", "")
+        if existing_secret != secret_name:
+            logger.info(
+                f"Tailnet {crd_name} has secretName={existing_secret!r}, "
+                f"expected {secret_name!r} — recreating"
+            )
+            custom_api.delete_cluster_custom_object(
+                TAILNET_API["group"], TAILNET_API["version"],
+                TAILNET_API["plural"], crd_name,
+            )
+            custom_api.create_cluster_custom_object(
+                TAILNET_API["group"], TAILNET_API["version"],
+                TAILNET_API["plural"], body,
+            )
+            logger.info(f"Recreated Tailnet {crd_name}")
+        else:
+            logger.info(f"Tailnet {crd_name} already exists")
     except ApiException as exc:
         if exc.status == 404:
             custom_api.create_cluster_custom_object(
@@ -119,6 +111,7 @@ def _delete_tailnet(custom_api, crd_name, logger):
     except ApiException as exc:
         if exc.status != 404:
             logger.warning(f"Failed to delete Tailnet {crd_name}: {exc}")
+            raise
 
 
 def _ensure_proxy_group(custom_api, crd_name, labels, default_tags, logger):
@@ -200,6 +193,7 @@ def _delete_proxy_group(custom_api, crd_name, logger):
     except ApiException as exc:
         if exc.status != 404:
             logger.warning(f"Failed to delete ProxyGroup {pg_name}: {exc}")
+            raise
 
 
 # ---------------------------------------------------------------------------
@@ -212,30 +206,26 @@ def _delete_proxy_group(custom_api, crd_name, logger):
 def reconcile_operator(spec, name, namespace, memo, logger, retry, **kwargs):
     if not spec and retry < 5:
         raise kopf.TemporaryError("spec is not yet populated", delay=1)
+    if not spec:
+        raise kopf.PermanentError("spec is empty after 5 retries, giving up")
 
-    client_id = spec["clientId"]
-    operator_image = spec["operatorImage"]
+    default_tags = spec.get("defaultTags", "")
     default_tags = spec.get("defaultTags", "")
     org_slug = spec["organizationSlug"]
 
     labels = _labels(org_slug)
     tailnet_secret_name = f"tailscale-tailnet-{name}"
-    # The single operator runs in the cabotage namespace
-    operator_namespace = "tailscale"
 
     custom_api = kubernetes.client.CustomObjectsApi()
 
     # 1. Tailnet CRD (cluster-scoped) — references the credential Secret
     #    (cabotage-app creates the Secret before enqueuing the CRD)
     _ensure_tailnet(custom_api, name, tailnet_secret_name, labels, logger)
 
-    # 3. ProxyGroup (cluster-scoped) — references the Tailnet
+    # 2. ProxyGroup (cluster-scoped) — references the Tailnet
     _ensure_proxy_group(custom_api, name, labels, default_tags, logger)
 
-    # Extract version from operator image tag
-    version = operator_image.rsplit(":", 1)[-1] if ":" in operator_image else "unknown"
-
-    return {"state": "deployed", "operatorVersion": version}
+    return {"state": "deployed"}
 
 
 @kopf.on.delete("cabotagetailscaleoperatorconfigs")