Tailscale K8s Operator

Dylan Stephano-Shachter Publisher

Platform:

Channel Revision Published Runs on
latest/edge 3 30 Jul 2026
Ubuntu 24.04 
juju deploy tailscale-k8s --channel edge

Learn to deploy on juju >

Learn about configurations >

  • credentials | secret

    Juju secret containing OAuth client credentials for manual mode. The secret must contain 'client-id' and 'client-secret' fields. Mutually exclusive with the tailscale-credentials relation - if both are present, the charm blocks.

  • login-server | string

    URL of the Tailscale control plane. Leave empty for Tailscale SaaS (https://controlplane.tailscale.com). Set to the Headscale URL for Headscale deployments (e.g. https://headscale.example.com).

  • operator-tags | string

    Default: tag:k8s-operator

    Comma-separated list of tags to apply to the operator device. These tags are applied via OPERATOR_INITIAL_TAGS env var. The credential must carry these tags for the operator to authenticate.

  • proxy-tags | string

    Default: tag:k8s

    Comma-separated list of tags to apply to proxy pods. These tags are applied via PROXY_TAGS env var. The operator tag must own these tags in tagOwners for proxy auth to succeed.