Rather tricky to deploy and use with Kubernetes

[calmh]

I'd like to use tsidp for some services deployed in the same cluster. However, this seems tricky or impossible (I haven't succeeded, at least). The problems, as I experience them:

• tsidp uses its own internal Tailscale client for listening, meaning it's not possible to point a local Service toward it.
• Without a Service, other cluster workloads could only talk to it via its Tailscale address.
• Creating an externalName service with the Tailscale Operator appears to work, but any communication times out. I'm guessing this has something to do with the pods not being able to establish VPN within the cluster.
• There's an option for listening on a local port, but it appears hardcoded for localhost which would not work from outside the container.

I don't know if the internal Tailscale client is somehow fundamental to how it works, but if it could run as a normal workload behind a service and a Tailscale ingress, that would solve all the operational problems.

It needs to have the ability to be reachable via Tailscale by clients, but respond to token exchanges etc on a cluster address.

[sam-intigriti]

We created a deployment where the hostname ends up as ts-idp.<tailnet>.ts.net

To make it reachable on k8s u can do something like this (note that the operator is required):

apiVersion: v1
kind: Service
metadata:
  name: ts-idp
  namespace: ts-idp
  annotations:
    tailscale.com/tailnet-fqdn: ts-idp.<tailnet>.ts.net
spec:
  type: ExternalName
  externalName: placeholder

The annotation needs to match the hostname the pod has in there.

Would ofcourse be a lot easier if we could put a service in front of it and use a k8s native setup instead.

[calmh]

Does this actually work for you, though? It doesn't for me, it's my third bullet point above.

[sam-intigriti]

Tested it with a sample app using these values on the same cluster and that worked:

        auth_url: https://ts-idp.<tailnet>.ts.net/authorize
        token_url: https://ts-idp.<tailnet>.ts.net/token
        user_info_url: https://ts-idp.<tailnet>.ts.net/userinfo

Edit: and used below annotation on the implementing app tailscale ingress:

        tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"