Add optional policy hot-reload sidecar

[kervel]

Summary

• Adds an optional kiwigrid/k8s-sidecar as a native sidecar (restartable init container) to the headscale server deployment
• When policy.hotReload.enabled is true, ACL policy ConfigMap changes are synced into the pod without requiring a restart
• Disabled by default — users with Stakater Reloader or similar tools can continue using their existing setup

Inspired by the policy hot-reload concept in #7.

Changes

• values.yaml / values.schema.json — new policy.hotReload section with configurable image
• deployment.yaml — conditional sidecar init container, policy volume switches from ConfigMap to emptyDir when hot-reload is on, policy checksum annotation skipped (sidecar handles updates)
• policy-configmap.yaml — conditional headscale-policy: "true" label for sidecar discovery
• serviceaccount.yaml — conditional Role/RoleBinding granting ConfigMap list/get/watch
• configmap.yaml — policy path adjusts to /etc/headscale/policy/policy.json when hot-reload is on

Configuration

policy:
  enabled: true
  hotReload:
    enabled: true
    image:
      repository: kiwigrid/k8s-sidecar
      tag: "1.30.3"
      pullPolicy: IfNotPresent

Test plan

• helm lint passes with default values
• helm lint passes with policy.hotReload.enabled=true
• Template renders sidecar, RBAC, and label only when hot-reload is enabled
• Template renders standard ConfigMap mount when hot-reload is disabled
• Works with both policy.enabled=true and client.advertiseRoutes paths
• Kind smoke test (--with-hot-reload): sidecar running, RBAC created, label applied, policy file synced by sidecar

🤖 Generated with Claude Code