Cloud native
Tailscale Kubernetes Operator: access the cluster without a public management interface.
The Operator can connect Kubernetes API access, services and workloads to a tailnet and implement ingress, egress, connector and recorder models. A production implementation requires restricted OAuth scopes, named identities, policy, release-stage checks and lifecycle management.
Use cases
The Operator is an implementation component, not a complete architecture.
The same Operator can serve very different needs. Each use case is scoped as a separate access path, checked against its current release stage and tested for both allowed and denied behaviour. The Kubernetes API server proxy is currently beta.
Kubernetes API
- beta API server proxy for administrators and automation
- tailnet identity and Tailscale access control
- Kubernetes authentication and RBAC remain in the cluster
Ingress and egress
- expose a service to the tailnet without public ingress
- connect a workload to a tailnet resource
- DNS, routing and availability
Cross-cluster, connectors and recorder
- access paths between clusters
- subnet, exit-node or app-connector roles
- separate trust, recording and administrative boundaries
Production requirements
OAuth, tags and decommissioning must be designed before installation.
- OAuth client scopes and tag ownership are restricted.
- Operator and proxy keys and permissions are rotated.
- Namespace, service and workload owners are named.
- High availability, upgrades, logs and failure scenarios are documented.
- Cluster RBAC and application permissions remain separate controls.
Shared responsibility
Tailscale manages the connectivity and identity layer. Kubernetes RBAC, pod security, secrets, network policies, application permissions and cloud-platform controls remain part of the customer's environment.
AIM model
The Operator is implemented as part of a production access path.
Advice defines use cases, identities, trust boundaries, feature maturity and the plan. Integrate installs the Operator, OAuth client, proxy resources, policies and tests. Manage maintains versions, identities, keys and documentation.
