forwarder.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy-proxy
  namespace: default
data:
  envoy.yaml: >
    static_resources:
      listeners:
      - address:
          socket_address:
            address: 0.0.0.0
            port_value: 80
        use_original_dst: true
        filter_chains:
        - filters:
          - name: envoy.http_connection_manager
            config:
              codec_type: auto
              tracing:
                operation_name: ingress
              stat_prefix: ingress_http
              route_config:
                name: proxy_route
                virtual_hosts:
                - name: proxy
                  domains:
                  - "*"
                  routes:
                  - match:
                      prefix: "/"
                    route:
                      cluster: local_service
                    decorator:
                      operation: proxy-envoy-ingress
              http_filters:
              - name: envoy.router
                config: {}
      clusters:
      - name: local_service
        connect_timeout: 0.250s
        type: strict_dns
        lb_policy: round_robin
        hosts:
        - socket_address:
            address: nginx
            port_value: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: proxy
  labels:
    app: proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: proxy
  template:
    metadata:
      labels:
        app: proxy
    spec:
      containers:
      - name: envoy
        image: envoyproxy/envoy-alpine:v1.14.2
        command: ["envoy"]
        args: ["-c", "/etc/envoy.yaml", "--service-cluster", "$(POD_NAME)"]
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        volumeMounts:
        - name: envoy-yaml
          mountPath: /etc/envoy.yaml
          subPath: envoy.yaml
      - name: tailscale
        image: <registry>/tailscale
        securityContext:
          capabilities:
            add:
              - NET_ADMIN
      volumes:
      - name: envoy-yaml
        configMap:
          name: envoy-proxy

some-service.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80