How to integrate Tailscale into k3s?

[AFKBETO]

Honestly, I spent the last two days trying to make this function but to no avail.

I saw that k3s supports Distributed hybrid or multicloud cluster using Tailscale so I have been trying that to run on my OCI instance (control plane) and VM (agent), but neither (as server node) works.

For example, CoreDNS pod on OCI tries to connect to the OCI's DNS resolver (169.254.169.254:53) but timeout and keeps restarting:

[ERROR] plugin/errors: 2 4231284254469202388.2483753640335683092. HINFO: read udp 10.42.0.14:49386->169.254.169.254:53: i/o timeout

The same error occurs on my homelab VM, unable to connect to the DNS resolver of my private network.

Here is my installation args:

curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--tls-san <ip_address>" sh -s - --docker --vpn-auth="name=tailscale,joinKey=<tailscale_auth_key>" --cluster-init

My tailscale ACL:

{
	"acls": [
		{
			"action": "accept",
			"src":    ["tag:k8s", "10.42.0.0/16", "10.43.0.0/16"],
			"dst":    ["tag:k8s:*", "10.42.0.0/16:*", "10.43.0.0/16:*"],
		},
	],
	"autoApprovers": {
		"routes": {
			"10.42.0.0/16": ["my-email@address", "tag:k8s"],
			"10.43.0.0/16": ["my-email@address", "tag:k8s"],
		}
	},
	// other settings
}

This error does not appear if I don't add --vpn-auth args.

Note that I haven't even managed to connect an agent yet, just trying to make the server works with Tailscale.

Honestly, I don't really have to use Tailscale, but since I do not have a static public IP on my homelab VM, and I already have Tailscale, so I pick that option. If there is other option then I'll pick that one.

[dereknola]

@manuelbuil might have more insight, but off the top of my head, I see that you didn't include --node-external-ip=<TailscaleIPOfServerNode> that the docs say to include.

[brandond]

For example, CoreDNS pod on OCI tries to connect to the OCI's DNS resolver (169.254.169.254:53) but timeout and keeps restarting

I don't think this issue is unique to use of tailscale, is it? How are routes on your node set up to handle traffic to this address? 169.254.0.0/16 is meant to be only for link-local traffic, I wouldn't expect pods to be able to reach it.

[AFKBETO]

Hmm, tbh I'm not too well-versed in networking. How can I check it? I still keep the iptables config that works with my previous single-node k3s deployment. That also worked with Tailscale operator. Only when adding Tailscale VPN that CoreDNS and other services stop working.

[theboringhumane]

For “how can I check it?”, these are read-only starting points on the affected server:

ip rule show
ip route show table all
ip route get 169.254.169.254
kubectl -n kube-system get configmap coredns -o yaml

The route lookup shows the host's path to that resolver; forwarded Pod traffic can take a different path. Compare the rules and tables with the working configuration, and check what CoreDNS actually forwards to.

Also check whether K3s has a resolv-conf override. The current K3s documentation says its automatic resolver checks reject link-local nameservers, but an explicitly supplied resolver file bypasses those checks. A dedicated resolver file needs a DNS server reachable from the Pods. The timeout alone doesn't tell us whether routing, firewalling or resolver selection is responsible, so I'd establish those paths before changing the tailnet ACL.