Documentation
Technologies
Networking
VPN
Tailscale Deployment

Tailscale Deployment

Reference

Add under spec.vpn.tailscale in the cluster definition:

spec:
  vpn:
    tailscale:
      enabled: true
      oauthClientID: your-oauth-client-id
      oauthClientSecretPayload: kms-encrypted-secret
      replicas: 2
      extraRoutes:
        - "192.168.248.0/24"
      resources:
        requests:
          cpu: "100m"
          memory: "128Mi"
ParameterTypeDefaultDescription
enabledbooleanfalseEnable or disable Tailscale integration
oauthClientIDstring-OAuth Client ID of the operator client (tagged tag:k8s-operator)
oauthClientSecretPayloadstring-KMS-encrypted OAuth Client Secret with the k8s_stack=secrets context
replicasinteger2Number of connector replicas
extraRouteslist(string)[]Additional CIDR blocks to advertise
exitNode.enabledbooleanfalseEnable exit node functionality (runs as a separate connector device)
resourcesobject100m CPU, 128Mi memoryCompute resources for the connector pods (requests.cpu, requests.memory, limits.memory)
apiServerProxy.enabledbooleanfalseExpose the Kubernetes API server over Tailscale
apiServerProxy.modestringauthauth (tailnet identity, Tailscale grants decide access) or noauth (Kubernetes RBAC only)
proxyGroupslist(object)[]Ingress/egress ProxyGroups, each restricted to a namespace allowlist (see below)

Adding Custom Routes

To advertise additional network ranges (e.g., peered VPCs, on-premises networks):

spec:
  vpn:
    tailscale:
      extraRoutes:
        - "192.168.0.0/16"    # On-premises network
        - "172.31.0.0/16"     # Peered VPC

Enabling Exit Node

An exit node routes all of a device’s internet traffic through the cluster, for example to reach services that allow-list the cluster’s egress IP, or when working from an untrusted network. Enable it on your tailnet with:

spec:
  vpn:
    tailscale:
      exitNode:
        enabled: true

The exit node runs as a separate connector device, hostname <cluster-name>-exit, tagged tag:<cluster-name>-exitnode. Update your ACL policy before you enable it:

  • Own the tag in tagOwners, otherwise the device cannot join the tailnet.
  • List the tag under autoApprovers.exitNode, so the exit node is approved without a manual step in the admin console.
  • Grant the users who may use it access to autogroup:internet; without that grant the exit node shows up but traffic through it is denied.

The Skyscrapers-managed connector has the same switch under spec.sksMgmt.tailscale.exitNode.enabled.

Resource Tuning

Adjust resource requests based on your traffic patterns:

spec:
  vpn:
    tailscale:
      resources:
        requests:
          cpu: "200m"        # Increase for high-throughput scenarios
          memory: "256Mi"    # Increase for many simultaneous connections
        limits:
          memory: "256Mi"
      replicas: 3            # Add more replicas for higher availability

These values are set statically on the connector pods (via the operator’s ProxyClass); adjust them if traffic patterns require it.

Exposing namespaces over the tailnet (ProxyGroups)

proxyGroups defines ingress/egress ProxyGroups, each restricted to an explicit namespace allowlist. Workloads in other namespaces cannot publish onto or egress through that ProxyGroup (rejected at admission).

spec:
  vpn:
    tailscale:
      proxyGroups:
        - name: customer-apps
          type: ingress        # ingress (expose Services to the tailnet) or egress
          replicas: 2
          namespaces:
            - customer-apps    # only this namespace may use the ProxyGroup

For how to actually expose a service, set up egress, or reach the API server over Tailscale once these are enabled, see Tailscale capabilities.

Last updated on
Tailscale Data and LoggingTailscale Setup