Tailscale-native Kubernetes accessSkip the proxies, VPNs, and OIDC headaches.

Secure, short-lived cluster access — powered entirely by your Tailscale identity and network.

Why Tailscale K8s Auth?

Built for Kubernetes. Powered by your tailnet.

No public endpoints. Access is gated by your Tailscale ACLs, identity, and devices — and nothing else.

All kubeconfigs are short-lived and auto-expiring. You get access when you need it, and not a second longer.

Grants are mapped to native ClusterRoles, and credentials are provisioned as real Kubernetes ServiceAccounts.

Use a CRD to define how Tailscale users, groups, or tags map to Kubernetes roles — GitOps ready.

Say goodbye to reverse proxies and auth headers. Access is handled with direct, secure API calls inside the tailnet.

Great for dev/test environments that spin up and down frequently — join the tailnet, register, and go.

Supports a central login cluster with other clusters registering dynamically — ideal for multi-cluster orgs.

Lightweight Go components designed to be extended, embedded, or scripted into your own workflows.