# This file is not a complete manifest, it's a skeleton that the operator embeds
# at build time and then uses to construct Tailscale proxy pods.
apiVersion: apps/v1
kind: StatefulSet
metadata: {}
spec:
  replicas: 1
  template:
    metadata:
      deletionGracePeriodSeconds: 10
    spec:
      serviceAccountName: proxies
      initContainers:
        - name: sysctler
          securityContext:
            privileged: true
          command: ["/bin/sh"]
          args:
            - -c
            - sysctl -w net.ipv4.ip_forward=1 net.ipv6.conf.all.forwarding=1
      resources:
        requests:
          cpu: 1m
          memory: 1Mi
      containers:
        - name: tailscale
          imagePullPolicy: Always
          env:
            - name: TS_USERSPACE
              value: "false"
            - name: TS_AUTH_ONCE
              value: "true"
          securityContext:
            privileged: true

apiVersion: v1
kind: Service
metadata:
  annotations:
    tailscale.com/tailnet-fqdn: service-name.example-name.ts.net
  name: service-name
spec:
  externalName: placeholder
  type: ExternalName

apiVersion: v1
kind: Service
metadata:
  name: example-service
spec:
  type: LoadBalancer
  loadBalancerClass: tailscale
  ports:
  - name: http
    port: 8888
    protocol: TCP
    targetPort: http
  selector:
    app.kubernetes.io/instance: example
    app.kubernetes.io/name:  example