integration: run the k8s operator over HTTP with reusable k3sic blocks

HTTP-by-IP drops the CA-baking and containerd image import (recipe kept in tls-ca-baking.md). Operator/workload steps become reusable k3sic methods; proxies reach the embedded non-TLS DERP over plain-HTTP websockets. Adds hsic.CreateOAuthClient and tsic.WithDERPOverHTTP; test covers connector, ingress connectivity and proxy groups.

Updates #1202

Author: kradalby

integration/control.go

@@ -1,6 +1,7 @@
 package integration
 
 import (
+	"context"
 	"net/netip"
 
 	clientv1 "github.com/juanfont/headscale/gen/client/v1"
@@ -22,6 +23,8 @@ type ControlServer interface {
 	ConnectToNetwork(network *dockertest.Network) error
 	GetHealthEndpoint() string
 	GetEndpoint() string
+	GetIPEndpoint() string
+	CreateOAuthClient(ctx context.Context, scopes, tags []string) (string, string, error)
 	WaitForRunning() error
 	Restart() error
 	CreateUser(user string) (*clientv1.User, error)

integration/hsic/hsic.go

@@ -6,6 +6,7 @@ import (
 	"cmp"
 	"context"
 	"crypto/tls"
+	"crypto/x509"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -1023,6 +1024,102 @@ func (t *HeadscaleInContainer) GetEndpoint() string {
 	return t.getEndpoint(false)
 }
 
+var errOAuthSecretMissing = errors.New(`OAuth client response missing secret in "key" field`)
+
+// CreateOAuthClient mints an admin API key and uses it to create an OAuth client
+// via the v2 keys HTTP API (POST /api/v2/tailnet/-/keys, keyType=client),
+// returning the client id and secret. The secret is only returned once, in the
+// "key" field. It is a reusable building block for tests that need OAuth client
+// credentials (such as the Kubernetes operator).
+func (t *HeadscaleInContainer) CreateOAuthClient(
+	ctx context.Context,
+	scopes, tags []string,
+) (string, string, error) {
+	apiKey, err := t.Execute([]string{"headscale", "apikeys", "create", "--expiration", "24h"})
+	if err != nil {
+		return "", "", fmt.Errorf("creating admin api key: %w", err)
+	}
+
+	apiKey = strings.TrimSpace(apiKey)
+
+	reqBody, err := json.Marshal(map[string]any{
+		"keyType": "client",
+		"scopes":  scopes,
+		"tags":    tags,
+	})
+	if err != nil {
+		return "", "", fmt.Errorf("marshalling key request: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(
+		ctx, http.MethodPost, t.GetEndpoint()+"/api/v2/tailnet/-/keys", bytes.NewReader(reqBody))
+	if err != nil {
+		return "", "", fmt.Errorf("building key request: %w", err)
+	}
+
+	req.Header.Set("Authorization", "Bearer "+apiKey)
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := t.httpClient().Do(req)
+	if err != nil {
+		return "", "", fmt.Errorf("posting key request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+
+		return "", "", fmt.Errorf( //nolint:err113
+			"creating OAuth client: status %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+
+	var out struct {
+		ID  string `json:"id"`
+		Key string `json:"key"`
+	}
+
+	err = json.NewDecoder(resp.Body).Decode(&out)
+	if err != nil {
+		return "", "", fmt.Errorf("decoding key response: %w", err)
+	}
+
+	if out.Key == "" {
+		return "", "", errOAuthSecretMissing
+	}
+
+	// The operator expects clientId and clientSecret as separate values. When the
+	// server returns a single opaque credential, the client-credentials grant
+	// splits it on "-" (id-secret), matching the Tailscale SaaS shape. Fall back
+	// to the whole key as the secret when no id is given.
+	clientID, clientSecret := out.ID, out.Key
+
+	if clientID == "" {
+		if id, secret, ok := strings.Cut(out.Key, "-"); ok {
+			clientID, clientSecret = id, secret
+		}
+	}
+
+	return clientID, clientSecret, nil
+}
+
+// httpClient returns an HTTP client that trusts this Headscale's TLS CA when TLS
+// is enabled, or a default client when it serves plain HTTP.
+func (t *HeadscaleInContainer) httpClient() *http.Client {
+	if !t.hasTLS() {
+		return &http.Client{Timeout: 30 * time.Second}
+	}
+
+	pool := x509.NewCertPool()
+	pool.AppendCertsFromPEM(t.tlsCACert)
+
+	return &http.Client{
+		Timeout: 30 * time.Second,
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{RootCAs: pool, MinVersion: tls.VersionTLS12},
+		},
+	}
+}
+
 // GetIPEndpoint returns the Headscale endpoint using IP address instead of hostname.
 func (t *HeadscaleInContainer) GetIPEndpoint() string {
 	return t.getEndpoint(true)