tailscale-talos

Tailscale on Talos Linux

Talos has no SSH/shell — Tailscale runs as a system extension at the OS level, not as a user-space daemon. This gives the node a persistent Tailscale interface independent of Kubernetes.

Architecture

Talos Node
  └── OS Kernel with Tailscale extension (siderolabs/tailscale)
        └── ExtensionServiceConfig (env vars: TS_AUTHKEY, TS_ROUTES, etc.)
              └── tailscale0 interface (100.x.y.z)
                    ├── talosctl management via tailscale IP
                    ├── Kubernetes API via tailnet
                    └── Subnet routes (pod/service CIDRs) advertised to tailnet

Installation

1. Add Tailscale System Extension

Built via Talos Factory (https://factory.talos.dev). The schematic must include the siderolabs/tailscale extension.

# machine config (controlplane.yaml / worker.yaml)
machine:
  install:
    image: factory.talos.dev/installer/<schematic-id>:v1.13.0
    extensions:
      - image: ghcr.io/siderolabs/tailscale:v1.62.0

The extension provides the tailscale binary at the OS level. No tailscale up needed — configuration is via ExtensionServiceConfig.

2. Configure Tailscale Auth

apiVersion: v1alpha1
kind: ExtensionServiceConfig
metadata:
  name: tailscale
spec:
  environment:
    - TS_AUTHKEY=tskey-auth-xxxxxxxxxxxxxxxxxxxx
    - TS_EXTRA_ARGS=--advertise-tags=tag:talos,tag:k8s --accept-dns=false
    - TS_HOSTNAME=talos-cp-1

Or via machine.files (alternative, works the same):

machine:
  files:
    - content: |
        TS_AUTHKEY=tskey-auth-xxxxxxxxxxxxxxxxxxxx
        TS_EXTRA_ARGS=--advertise-tags=tag:talos,tag:k8s --accept-dns=false
        TS_HOSTNAME=talos-cp-1
      path: /var/etc/tailscale/auth.env
      permissions: 0o600
      op: create

3. Critical: Bind Node IP to Physical Network (not Tailscale)

Without this, kubelet binds to the Tailscale IP, etcd peers over tailnet, and the cluster breaks on node reboot.

machine:
  kubelet:
    nodeIP:
      validSubnets:
        - 192.168.1.0/24    # Your physical/private subnet — NOT tailscale (100.x.y.z)
  cluster:
    etcd:
      advertisedSubnets:
        - 192.168.1.0/24    # Same physical subnet