Tailscale Kubernetes Operator
The Tailscale operator enables Kubernetes services to be exposed directly on the Tailscale network via Ingress resources.
Quick Reference
| Property | Value |
|---|---|
| Namespace | tailscale |
| Upstream | mirrors/tailscale on forge (static manifest) |
| ArgoCD Apps | tailscale-operator-base (upstream), tailscale-operator (config) |
How It Works
Ingresses use a shared ProxyGroup (ingress) rather than per-service Tailscale nodes. When you create an Ingress with ingressClassName: tailscale:
- Operator configures the shared ProxyGroup pods to serve the new Ingress
- Service gets a VIP (Virtual IP) address on the tailnet
- Service becomes accessible at
<hostname>.tail8d86e.ts.net - TLS is handled automatically via Tailscale
Tailnet clients must have --accept-routes enabled to route to VIP addresses.
Services can be individually tagged (e.g., tag:flyio-target) via Ingress annotations to control which ACL grants apply. See expose-service-publicly for the tagging workflow.
Limitations
Services exposed via Tailscale Ingress are not accessible from:
- Other Kubernetes pods (they’re not Tailscale clients)
- Docker containers on indri
For pod-to-service communication, use Caddy (*.ops.eblu.me) instead.