infra/home/k3s/tailscale

Tailscale Operator for K3s

This directory contains the Kubernetes manifests to deploy the Tailscale operator and expose services via your Tailscale network.

Prerequisites

1. Create OAuth credentials in Tailscale Admin Console:

   • Go to https://login.tailscale.com/admin/settings/oauth
   • Create new OAuth client
   • Add these scopes (permissions):
     • Devices - Write (required to create/manage proxy devices)
     • Auth keys - Write (required to authenticate new devices)
     • Routes - Write (only if advertising subnet routes)
     • DNS - Write (only if using MagicDNS hostnames)
   • Add tags: tag:k8s (or create this tag in ACLs)

2. Update the OAuth credentials in 00-namespace.yaml:

   stringData:
     client_id: "YOUR_CLIENT_ID"
     client_secret: "YOUR_CLIENT_SECRET"
   

Deploy the Operator

Apply all manifests in order:

kubectl apply -f 00-namespace.yaml
kubectl apply -f 01-rbac.yaml
kubectl apply -f 02-operator.yaml
kubectl apply -f 03-proxyclass.yaml
kubectl apply -f 04-ingressclass.yaml
kubectl apply -f 04-expose-nodered.yaml

Verify Deployment

Check the operator is running:

kubectl -n tailscale get pods
kubectl -n tailscale logs deployment/operator

Access Services

Once deployed, Node-RED will be accessible at:

• https://nodered (from any device on your Tailscale network)

The operator will create a dedicated Tailscale node for the service that appears in your Tailscale admin console.

Expose Additional Services

To expose more services, create an Ingress like:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: service-name
  namespace: service-namespace
spec:
  ingressClassName: tailscale
  rules:
  - host: service-name
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: existing-service
            port:
              number: 8080

Notes

• Services are only accessible to devices on your Tailscale network by default
• To expose publicly via Tailscale Funnel, add annotation: tailscale.com/funnel: "true"
• Each exposed service creates a separate Tailscale device in your network
• The operator manages the lifecycle of these proxy devices automatically