From b93da46e4ee191126ce9814fcbc365058e4f9836 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Mon, 8 Sep 2025 09:36:15 -0500
Subject: [PATCH] Fix K3s API TLS verification for Tailscale connection

Add insecure-skip-tls-verify flag to kubectl config to bypass certificate
validation when connecting via Tailscale IP. The K3s certificates don't
include the Tailscale IP in their SANs, causing TLS verification to fail.
---
 .github/workflows/deploy.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 26b7ae2..873ff53 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -71,6 +71,8 @@ jobs:
         run: |
           mkdir -p ~/.kube
           echo "${{ secrets.TAILSCALE_KUBECONFIG }}" | base64 -d > ~/.kube/config
+          # Skip TLS verification for Tailscale IP connection
+          kubectl config set-cluster default --insecure-skip-tls-verify=true
 
       - name: Deploy to K3s
         run: |