Provisioning k3s clusters over Tailscale

说明与用途

tailk3s 是一个 CLI 工具，利用 Tailscale 创建私有网络并管理访问，快速在多云环境中部署 k3s 集群，消除了 VPC、NAT 网关和供应商特定防火墙规则的需求。

问题

Provisioning a Kubernetes cluster across multiple cloud providers without vendor‑specific networking and firewall configuration.

结果

tailk3s enables fast, vendor‑agnostic k3s cluster provisioning with secure defaults, eliminating the need for provider‑specific networking, firewall rules, and configuration management layers.

工作流

• Read cluster HCL file and validate nodes
• Update Tailscale access policy with node tags and SSH rule
• Create single‑use Tailscale auth keys for nodes
• Connect to each node via provider SSH and install base packages, hostname, admin user, and Tailscale
• Join nodes to Tailscale tailnet using their tags
• Connect via Tailscale SSH, close public firewall except 80/443, install and configure k3s
• If joining an existing cluster, retrieve join token and apply
• Generate kubeconfig and SSH config on the laptop
• Delete provider login and rely on Tailscale SSH for access

证据

The previous setup used Ansible playbooks. They worked, but they were a second codebase with its own abstractions, and every new provider meant another set of assumptions about networking, users and firewall tools.

来源

tailk3s prepares the tailnet, gets each machine onto it, and then finishes the cluster over it.

来源

The tool runs on your machine and joins the tailnet itself, as a node tagged tag:tailk3s. You do not need Tailscale installed on your laptop.

来源

By the time Kubernetes is being installed, the network already exists. Every machine has the same kind of private address it would have had inside a single VPC, and that address does not change when the cluster moves to another provider.

来源

The obvious win is that there is no vendor lock‑in. Any provider that gives you a Linux server and SSH works.

来源