Provisioning k3s clusters over Tailscale

Описание и применение

tailk3s — это CLI‑инструмент, позволяющий быстро развернуть кластеры k3s на разных облачных провайдерах, используя Tailscale для создания приватной сети и управления доступом, устраняя необходимость в настройке VPC, NAT‑шлюзов и правил брандмауэра.

Задача

Provisioning a Kubernetes cluster across multiple cloud providers without vendor‑specific networking and firewall configuration.

Результат

tailk3s enables fast, vendor‑agnostic k3s cluster provisioning with secure defaults, eliminating the need for provider‑specific networking, firewall rules, and configuration management layers.

Рабочий процесс

• Read cluster HCL file and validate nodes
• Update Tailscale access policy with node tags and SSH rule
• Create single‑use Tailscale auth keys for nodes
• Connect to each node via provider SSH and install base packages, hostname, admin user, and Tailscale
• Join nodes to Tailscale tailnet using their tags
• Connect via Tailscale SSH, close public firewall except 80/443, install and configure k3s
• If joining an existing cluster, retrieve join token and apply
• Generate kubeconfig and SSH config on the laptop
• Delete provider login and rely on Tailscale SSH for access

Доказательства

The previous setup used Ansible playbooks. They worked, but they were a second codebase with its own abstractions, and every new provider meant another set of assumptions about networking, users and firewall tools.

Источник

tailk3s prepares the tailnet, gets each machine onto it, and then finishes the cluster over it.

Источник

The tool runs on your machine and joins the tailnet itself, as a node tagged tag:tailk3s. You do not need Tailscale installed on your laptop.

Источник

By the time Kubernetes is being installed, the network already exists. Every machine has the same kind of private address it would have had inside a single VPC, and that address does not change when the cluster moves to another provider.

Источник

The obvious win is that there is no vendor lock‑in. Any provider that gives you a Linux server and SSH works.

Источник