fix(ingress-nginx): expose to Tailscale

kube/deploy/core/ingress/ingress-nginx/app/hr-external.yaml

@@ -27,6 +27,7 @@ spec:
         externalTrafficPolicy: "Cluster"
         annotations:
           "io.cilium/lb-ipam-ips": "${APP_IP_NGINX_EXTERNAL}"
+          tailscale.com/expose: "true"
       extraArgs:
         default-ssl-certificate: "ingress/short-domain-tls"
       ingressClassResource:

kube/deploy/core/ingress/ingress-nginx/app/hr-internal.yaml

@@ -26,6 +26,7 @@ spec:
         externalTrafficPolicy: "Cluster"
         annotations:
           "io.cilium/lb-ipam-ips": "${APP_IP_NGINX_INTERNAL}"
+          tailscale.com/expose: "true"
       extraArgs:
         default-ssl-certificate: "ingress/short-domain-tls"
       ingressClassResource:

kube/deploy/core/ingress/ingress-nginx/app/hr-public.yaml

@@ -27,6 +27,7 @@ spec:
         externalTrafficPolicy: "Cluster"
         annotations:
           "io.cilium/lb-ipam-ips": "${APP_IP_NGINX_PUBLIC}"
+          tailscale.com/expose: "true"
       extraArgs:
         default-ssl-certificate: "ingress/long-domain-tls"
       ingressClassResource:

kube/deploy/core/ingress/ingress-nginx/app/netpol.yaml

@@ -42,6 +42,10 @@ spec:
               protocol: TCP
             - port: "443"
               protocol: UDP
+    # allow traffic from Tailscale within cluster
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: tailscale
     # allow traffic from external-proxy-x
     - fromEndpoints:
         - matchLabels: