Adding helm chart

[twentybit]

This PR contains a working copy of a helm chart used to deploy tsidp on kubernetes. I raised #94 for this request.

I've included fsGroup and runAsUser defaults in the values.yaml to fix PVC storage caused by #113

I've not included a GitHub workflow as I'm not sure how you'd want to lint/test/release this (if this is accepted!). Happy collaborating on that part if this looks like a good base?

Here's a copy of the k8s manifests generated using the default values:
$ helm template --dry-run chart

---
# Source: tsidp/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: release-name-tsidp
  labels:
    helm.sh/chart: tsidp-0.1.0
    app.kubernetes.io/name: tsidp
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "latest"
    app.kubernetes.io/managed-by: Helm
automountServiceAccountToken: true
---
# Source: tsidp/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: release-name-tsidp
  labels:
    helm.sh/chart: tsidp-0.1.0
    app.kubernetes.io/name: tsidp
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "latest"
    app.kubernetes.io/managed-by: Helm
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: tsidp
      app.kubernetes.io/instance: release-name
  template:
    metadata:
      labels:
        helm.sh/chart: tsidp-0.1.0
        app.kubernetes.io/name: tsidp
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/version: "latest"
        app.kubernetes.io/managed-by: Helm
    spec:
      serviceAccountName: release-name-tsidp
      securityContext:
        fsGroup: 1001
      containers:
        - name: tsidp
          securityContext:
            readOnlyRootFilesystem: false
            runAsNonRoot: true
            runAsUser: 1001
          image: "ghcr.io/tailscale/tsidp:latest"
          imagePullPolicy: IfNotPresent
          env:
            - name: TAILSCALE_USE_WIP_CODE
              value: "1"
            - name: TS_STATE_DIR
              value: "/data"
            - name: TS_HOSTNAME
              value: "idp"
            - name: TSIDP_PORT
              value: "443"
            - name: TSIDP_ENABLE_STS
              value: "1"
          volumeMounts:
            - name: tsidp-data
              mountPath: /data
      volumes:
        - name: tsidp-data
          emptyDir: {}

[tiesmaster]

Awesome to see an helm chart get added to this. I've made a helm chart for golink, and I've found the following things useful, maybe these things can be added to this chart as well:

• be able to provide the auth key also via an existing secret (so you can provide the auth key via sealed-secrets, for example)
• control the --verbose flag, in order to troubleshoot things, so I suppose -log-level here

I can help adopting that, if we want this, or make a follow-up PR, as an alternative.