valentinalexeev/tailscale-ingress-controller repository overview

⁠Tailscale Ingress Controller

This is a Kubernetes Ingress Controller⁠ for Tailscale⁠. The controller will create a Tailscale node⁠ for each host present in an Ingress resource and then route all incoming traffic to the correct backend service.

⁠How to deploy

An IngressController resource definition is available on Github⁠

⁠How it works

A standard Kubernetes Ingress resource can be used to expose a service on the tailnet. Here is a sample resource definition

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tailscale-ingress
spec:
# Uncomment the tls block below to generate a certificate for your Tailscale node
# (Requires going to "Configure HTTPS" in the Tailscale admin panel)
#  tls:
#    - hosts:
#        - demo
  rules:
    - host: demo
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: demo-backend
                port:
                  number: 8080

⁠Tailscale SSO

As Tailscale provides authentication information as part of the requests the Ingress Controller is able to supply this information to the services.

The controller proxy server will parse the remote IP address from Tailscale and add X-Webauth-User and X-Webauth-Name HTTP headers to the request before forwarding it for the Tailscale login name and display name, respectively.

The services can be configured to use the provided headers as SSO credentials. See sample use case on How To Seamlessly Authenticate to Grafana using Tailscale⁠

⁠TLS support

Tailscale provides native HTTPS implementation with certificates by Let's Encrypt.

If the host is also listed in the tls section of the Ingress spec (see comment in the example Ingress to try it), then the Tailscale node will proxy requests from port 443 instead of 80 and automatically generate a certificate for itself⁠.

⁠Funnel support

The Ingress Controller allows the use of Tailscale Funnel⁠ to expose services to the public network.

Unlike HTTPS support, to enable Funnel for an Ingress point a custom annotation tailscale.com/funnel: "true" needs to be added to the resource definition.

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tailscale-ingress-funnel
  annotations:
    tailscale.com/funnel: "true"
spec:
  rules:
    - host: demo-funnel
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: demo-backend
                port:
                  number: 8080

Please refer to the Tailscale documentation on additional opt-in actions (nodeAttrs and ACL tag set-up) required to make Funnel enabled for the services.

⁠TCP service support

The TCP support was inspired by the ingress-nginx and relies on a dedicated ConfigMap with a mapping between virtual Tailscale nodes and kubernetes services.

To configure tailscale-ingress-controller to proxy TCP requests the following settings must be done:

• Create a new ConfigMap that will include service mappings. The notation of the config map is the following:

...
data:
  # <Host>.<Port>: [<Namespace>/]<Service>:<Port>
  # A sample mapping to allow connection to the Clickhouse native port (deployed from a Bitnami Helm chart)
  clickhouse.9000: clickhouse/clickhouse-1687979852:9000

• Deploy controller with an additional environment variable TCP_SERVICES_CONFIGMAP set to the name of the newly created ConfigMap.

⁠Future Work

• Store Tailscale state in a Kubernetes Secret
• Support Ingress Classes
• High Availability

⁠Authors

• Michael Wilson http://github.com/mewil⁠
• Valentin Alekseev http://github.com/valentinalexeev⁠