Tailscale Deployment

Add under spec.tailscale in the cluster definition:

spec:
  tailscale:
    enabled: true
    oauth_client_id: your-oauth-client-id
    oauth_client_secret_payload: kms-encrypted-secret
    replicas: 2
    extra_routes:
      - "192.168.248.0/24"
    cpu_requests: "100m"
    memory: "128Mi"

Parameter	Type	Default	Description
`enabled`	boolean	`false`	Enable or disable Tailscale integration
`oauth_client_id`	string	-	OAuth Client ID of the operator client (tagged `tag:k8s-operator`)
`oauth_client_secret_payload`	string	-	KMS-encrypted OAuth Client Secret with the `k8s_stack=secrets` context
`replicas`	integer	`2`	Number of connector replicas
`extra_routes`	list(string)	`[]`	Additional CIDR blocks to advertise
`exit_node_enabled`	boolean	`false`	Enable exit node functionality (runs as a separate connector device)
`cpu_requests`	string	`"100m"`	CPU request per connector pod
`memory`	string	`"128Mi"`	Memory limit per connector pod
`api_server_proxy`	bool/string	`false`	Expose the Kubernetes API server over Tailscale (`true`, `false`, or `"noauth"`)
`proxy_groups`	list(object)	`[]`	Ingress/egress ProxyGroups, each restricted to a namespace allowlist (see below)

Adding Custom Routes

To advertise additional network ranges (e.g., peered VPCs, on-premises networks):

spec:
  tailscale:
    extra_routes:
      - "192.168.0.0/16"    # On-premises network
      - "172.31.0.0/16"     # Peered VPC

Enabling Exit Node (SKS-Managed Only)

To use the cluster as an exit node for all traffic:

spec:
  sksMgmt:
    tailscale:
      exit_node_enabled: true

Resource Tuning

Adjust resource requests based on your traffic patterns:

spec:
  tailscale:
    cpu_requests: "200m"   # Increase for high-throughput scenarios
    memory: "256Mi"        # Increase for many simultaneous connections
    replicas: 3            # Add more replicas for higher availability

These values are set statically on the connector pods (via the operator’s ProxyClass); adjust them if traffic patterns require it.

Exposing namespaces over the tailnet (ProxyGroups)

proxy_groups defines ingress/egress ProxyGroups, each restricted to an explicit namespace allowlist. Workloads in other namespaces cannot publish onto or egress through that ProxyGroup (rejected at admission).

spec:
  tailscale:
    proxy_groups:
      - name: customer-apps
        type: ingress        # ingress (expose Services to the tailnet) or egress
        replicas: 2
        namespaces:
          - customer-apps    # only this namespace may use the ProxyGroup

For how to actually expose a service, set up egress, or reach the API server over Tailscale once these are enabled, see Tailscale capabilities.

Last updated on June 24, 2026

Tailscale Data and Logging Tailscale Setup