Tailscale Deployment

Add under spec.vpn.tailscale in the cluster definition:

spec:
  vpn:
    tailscale:
      enabled: true
      oauthClientID: your-oauth-client-id
      oauthClientSecretPayload: kms-encrypted-secret
      replicas: 2
      extraRoutes:
        - "192.168.248.0/24"
      resources:
        requests:
          cpu: "100m"
          memory: "128Mi"

Parameter	Type	Default	Description
`enabled`	boolean	`false`	Enable or disable Tailscale integration
`oauthClientID`	string	-	OAuth Client ID of the operator client (tagged `tag:k8s-operator`)
`oauthClientSecretPayload`	string	-	KMS-encrypted OAuth Client Secret with the `k8s_stack=secrets` context
`replicas`	integer	`2`	Number of connector replicas
`extraRoutes`	list(string)	`[]`	Additional CIDR blocks to advertise
`exitNode.enabled`	boolean	`false`	Enable exit node functionality (runs as a separate connector device)
`resources`	object	`100m` CPU, `128Mi` memory	Compute resources for the connector pods (`requests.cpu`, `requests.memory`, `limits.memory`)
`apiServerProxy.enabled`	boolean	`false`	Expose the Kubernetes API server over Tailscale
`apiServerProxy.mode`	string	`auth`	`auth` (tailnet identity, Tailscale grants decide access) or `noauth` (Kubernetes RBAC only)
`proxyGroups`	list(object)	`[]`	Ingress/egress ProxyGroups, each restricted to a namespace allowlist (see below)

Adding Custom Routes

To advertise additional network ranges (e.g., peered VPCs, on-premises networks):

spec:
  vpn:
    tailscale:
      extraRoutes:
        - "192.168.0.0/16"    # On-premises network
        - "172.31.0.0/16"     # Peered VPC

Enabling Exit Node (SKS-Managed Only)

To use the cluster as an exit node for all traffic:

spec:
  sksMgmt:
    tailscale:
      exitNode:
        enabled: true

On your own tailnet (spec.vpn.tailscale.exitNode.enabled), the exit node runs as a separate connector device tagged tag:<cluster-name>-exitnode. Add that tag to tagOwners in your ACL policy before you enable it, otherwise the device cannot join the tailnet.

Resource Tuning

Adjust resource requests based on your traffic patterns:

spec:
  vpn:
    tailscale:
      resources:
        requests:
          cpu: "200m"        # Increase for high-throughput scenarios
          memory: "256Mi"    # Increase for many simultaneous connections
        limits:
          memory: "256Mi"
      replicas: 3            # Add more replicas for higher availability

These values are set statically on the connector pods (via the operator’s ProxyClass); adjust them if traffic patterns require it.

Exposing namespaces over the tailnet (ProxyGroups)

proxyGroups defines ingress/egress ProxyGroups, each restricted to an explicit namespace allowlist. Workloads in other namespaces cannot publish onto or egress through that ProxyGroup (rejected at admission).

spec:
  vpn:
    tailscale:
      proxyGroups:
        - name: customer-apps
          type: ingress        # ingress (expose Services to the tailnet) or egress
          replicas: 2
          namespaces:
            - customer-apps    # only this namespace may use the ProxyGroup

For how to actually expose a service, set up egress, or reach the API server over Tailscale once these are enabled, see Tailscale capabilities.

Last updated on September 1, 2026

Tailscale Data and Logging Tailscale Setup