Retired tailscale-operator still deployed with a dead OAuth token #30

New issue

Closed

opened 2026-05-23 20:54:30 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-05-23 20:54:30 +00:00

Owner

Originally filed by @coilysiren on 2026-05-22T08:21:09Z - https://github.com/coilysiren/infrastructure/issues/238

The tailscale-operator helm release was retired in favor of per-pod ts sidecars (see terraform/tailscale-oidc/main.tf and terraform/tailscale-devices/), but the operator Deployment is still running in the tailscale namespace on kai-server.

Its operator-oauth secret holds an expired OAuth client. Any Service annotated tailscale.com/expose now fails reconcile with 401 Unauthorized: API token invalid. Stale proxies (coilysiren-backend-service, forgejo, vmsingle) have already gone offline because the operator can no longer re-mint their keys.

Action

Uninstall the tailscale-operator helm release.
Clean up the leftover ts-* proxy StatefulSets and the operator / operator-oauth secrets in the tailscale namespace.
Update docs/architecture.md - it still draws the operator in the backend data path; the current pattern is the in-pod ts sidecar.

Surfaced while adding a ClusterIP for desktop DB-client access in coilysiren/backend#79.

_Originally filed by @coilysiren on 2026-05-22T08:21:09Z - [https://github.com/coilysiren/infrastructure/issues/238](https://github.com/coilysiren/infrastructure/issues/238)_ The tailscale-operator helm release was retired in favor of per-pod ts sidecars (see `terraform/tailscale-oidc/main.tf` and `terraform/tailscale-devices/`), but the operator Deployment is still running in the `tailscale` namespace on kai-server. Its `operator-oauth` secret holds an expired OAuth client. Any Service annotated `tailscale.com/expose` now fails reconcile with `401 Unauthorized: API token invalid`. Stale proxies (`coilysiren-backend-service`, `forgejo`, `vmsingle`) have already gone offline because the operator can no longer re-mint their keys. **Action** - Uninstall the `tailscale-operator` helm release. - Clean up the leftover `ts-*` proxy StatefulSets and the `operator` / `operator-oauth` secrets in the `tailscale` namespace. - Update `docs/architecture.md` - it still draws the operator in the backend data path; the current pattern is the in-pod ts sidecar. Surfaced while adding a ClusterIP for desktop DB-client access in coilysiren/backend#79.

coilysiren added the

priority

label

2026-06-04 08:16:56 +00:00

coilysiren commented

2026-06-17 08:22:56 +00:00

Author

Owner

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.

coilysiren

2026-06-17 08:22:56 +00:00