feat: run platform gateway through Tailscale sidecar

k8s/platform-gateway.yaml

@@ -1,3 +1,33 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: platform-gateway
+  namespace: studio-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: platform-gateway-tailscale-state
+  namespace: studio-system
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: platform-gateway-tailscale-state
+  namespace: studio-system
+subjects:
+  - kind: ServiceAccount
+    name: platform-gateway
+    namespace: studio-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: platform-gateway-tailscale-state
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -15,7 +45,30 @@ spec:
       labels:
         app: platform-gateway
     spec:
+      serviceAccountName: platform-gateway
       containers:
+        - name: tailscale
+          image: tailscale/tailscale:stable
+          env:
+            - name: TS_KUBE_SECRET
+              value: platform-gateway-tailscale-state
+            - name: TS_AUTHKEY
+              valueFrom:
+                secretKeyRef:
+                  name: platform-gateway-tailscale-auth
+                  key: authkey
+            - name: TS_HOSTNAME
+              value: platform-gateway
+            - name: TS_USERSPACE
+              value: "false"
+            - name: TS_EXTRA_ARGS
+              value: --login-server=https://atnmy-hs.duckdns.org --accept-routes
+          securityContext:
+            capabilities:
+              add: ["NET_ADMIN"]
+          volumeMounts:
+            - name: dev-net-tun
+              mountPath: /dev/net/tun
         - name: platform-gateway
           image: localhost:5000/platform-gateway:0.1.0
           imagePullPolicy: Always
@@ -37,6 +90,11 @@ spec:
               port: 4500
             initialDelaySeconds: 15
             periodSeconds: 20
+      volumes:
+        - name: dev-net-tun
+          hostPath:
+            path: /dev/net/tun
+            type: CharDevice
 ---
 apiVersion: v1
 kind: Service