Tailscale K8s Auth

Appearance

One command gets you secure kubectl access. No proxies, no OIDC setup, no hassle.Tailscale-native Kubernetes access

Ephemeral credentials that auto-expire, powered by your existing Tailscale network.

Get Started →View Documentation →

Why Tailscale K8s Auth?

Built for Kubernetes. Powered by your tailnet.

Zero-proxy simplicity

Direct API access without auth proxies, reverse tunnels, or complex gateway chains. Your kubectl talks directly to the cluster.

Ephemeral by design

Short-lived tokens that auto-expire. Get access exactly when you need it, for exactly as long as you need it.

Zero-trust, zero-ingress

No public endpoints. Access flows through your private Tailscale network with device-level attestation.

Kubernetes-native

Built on ServiceAccounts and ClusterRoles. No custom protocols or vendor lock-in - just native Kubernetes security.

Traditional vs. TKA

Compare the old way with the TKA approach

Traditional Kubernetes Access

Complex, fragile, and hard to maintain

  • •
    Complex Setup
    OIDC providers, auth proxies, bastion hosts
  • •
    Fragile Chains
    Multiple hops that break at the worst times
  • •
    Long-lived Tokens
    Shared credentials with limited rotation
  • •
    Manual Onboarding
    Per-environment setup and documentation drift
  • •
    Hard to Debug
    Complex auth flows with poor visibility

TKA Approach

Simple, secure, and Kubernetes-native

  • •
    One-Command Deploy
    Helm install. That's it. kubectl works immediately
  • •
    Zero Infrastructure
    Uses your existing Tailscale network
  • •
    Ephemeral Credentials
    Auto-expiring tokens with least privilege
  • •
    Instant Onboarding
    If you have Tailscale, you have access
  • •
    Clear Audit Trail
    Standard Kubernetes events and logs

Best-in-Class Developer Experience

TKA is built by SREs who understand production operations. Every workflow is designed for real-world reliability, security, and ease of use.

We provide two intuitive workflows to provide instant, secure access without the usual ceremony:

tka shell → ephemeral, isolated sessions (perfect for quick debugging and production safety)

Terminal
$ tka shell --quiet
✓ sign-in successful!

(tka) $ kubectl version | grep Server
Server Version: v1.31.1+k3s1

(tka) $ exit
✓ You have been signed out

tka login → persistent sessions with full control (ideal for development and administration)

Found a rough edge? Have an idea for improvement?

Open an issue - we're always working to make Kubernetes access better.

Security & Maturity

Security Model Status

TKA's security model is thoughtfully designed and suitable for many production use cases. However, it hasn't undergone formal security auditing yet.

For mission-critical environments requiring the highest security assurance, consider professionally audited solutions or review our security documentation to make an informed decision.

Releases

Select your platform

v0.3.1

Bug Fixes

  • deps: update go modules to v0.2.3 (#445) (bf50bb0)
  • deps: update module github.com/prometheus/client_golang to v1.25.0 (#451) (e3782ec)
  • deps: update module golang.org/x/sys to v0.49.0 (#458) (3b578b5)
  • deps: update module golang.org/x/term to v0.47.0 (#459) (b6b4d6e)
  • deps: update module tailscale.com to v1.104.1 (#450) (7627346)

v0.3.0

Release notes

⚠ BREAKING CHANGES

  • the CLI binary is now tka instead of ts-k8s-auth, in the release archives (now tka_<version>_<os>_<arch>.tar.gz) and in the deb, rpm and Arch packages (/usr/bin/tka). Scripts and shell configs that call ts-k8s-auth must call tka.

Features

  • implement wide events with span attributes for observability (#195) (a909d6a)
  • publish tka via Homebrew tap and ship the CLI as tka (#438) (e05cb8a)

Bug Fixes

  • deps: repair go.mod and bring Go modules current (#436) (9329bbb)
  • deps: update go modules (#359) (6f5ed68)
  • deps: update go modules (#372) (278a289)
  • deps: update go modules (#384) (7501cf7)
  • deps: update go modules (#395) (27d22ab)
  • deps: update go modules (#404) (84c48da)
  • deps: update go modules (#416) (bac7230)
  • deps: update go modules (#426) (c0050e1)
  • deps: update go modules (#431) (c48072c)
  • deps: update go modules (#434) (f411423)
  • deps: update kubernetes monorepo to v0.36.0 (#289) (f71554a)
  • deps: update kubernetes monorepo to v0.36.1 (#293) (e0ac6b2)
  • deps: update kubernetes monorepo to v0.36.2 (#328) (c6ea7b9)
  • deps: update kubernetes packages to v0.34.2 (#134) (6d92c0b)
  • deps: update kubernetes packages to v0.34.3 (#165) (cadaaaa)
  • deps: update kubernetes packages to v0.35.0 (#177) (d27b990)
  • deps: update kubernetes packages to v0.35.1 (#221) (9a0ae54)
  • deps: update kubernetes packages to v0.35.2 (#240) (4f67ab5)
  • deps: update module github.com/charmbracelet/bubbles to v0.21.1 (#211) (68a1373)
  • deps: update module github.com/charmbracelet/lipgloss/v2 to v2.0.0 (#234) (02eace3)
  • deps: update module github.com/charmbracelet/lipgloss/v2 to v2.0.1 (#247) (c4e95ff)
  • deps: update module github.com/charmbracelet/lipgloss/v2 to v2.0.2 (#254) (7f39c47)
  • deps: update module github.com/charmbracelet/lipgloss/v2 to v2.0.3 (#269) (0cbd5f1)
  • deps: update module github.com/charmbracelet/lipgloss/v2 to v2.0.4 (#329) (aa88529)
  • deps: update module github.com/charmbracelet/lipgloss/v2 to v2.0.5 (#350) (01f8114)
  • deps: update module github.com/charmbracelet/lipgloss/v2 to v2.0.6 (#387) (892bbd1)
  • deps: update module github.com/gin-contrib/zap to v1.1.6 (#152) (558cefe)
  • deps: update module github.com/gin-contrib/zap to v1.1.7 (#270) (69020c0)
  • deps: update module github.com/gin-contrib/zap to v1.1.8 (#413) (e05ab9d)
  • deps: update module github.com/gin-contrib/zap to v1.1.9 (#423) (827346a)
  • deps: update module github.com/gin-gonic/gin to v1.12.0 (#243) (281ab9f)
  • deps: update module github.com/mattn/go-isatty to v0.0.22 (#271) (6ce3762)
  • deps: update module github.com/mattn/go-isatty to v0.0.23 (#362) (fa49adf)
  • deps: update module github.com/prometheus/client_golang to v1.24.0 (#366) (25e1647)
  • deps: update module github.com/prometheus/client_golang to v1.24.1 (#374) (09cdadd)
  • deps: update module github.com/spechtlabs/go-otel-utils/otelprovider to v0.1.1 (#332) (7d08eb4)
  • deps: update module github.com/spechtlabs/go-otel-utils/otelzap to v0.1.1 (#334) (05a81b4)
  • deps: update module github.com/spf13/cobra to v1.10.2 (#157) (20cd9a7)
  • deps: update module github.com/stretchr/testify to v1.12.0 (#391) (d1965ea)
  • deps: update module github.com/zsais/go-gin-prometheus to v1.0.3 (#223) (b7d05c4)
  • deps: update module go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin to v0.64.0 (#167) (19dd915)
  • deps: update module go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin to v0.65.0 (#209) (eadc9ba)
  • deps: update module go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin to v0.67.0 (#258) (ff84893)
  • deps: update module go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin to v0.68.0 (#290) (5033bb1)
  • deps: update module go.opentelemetry.io/otel to v1.46.0 (#405) (d409350)
  • deps: update module go.uber.org/zap to v1.27.1 (#144) (c3453e8)
  • deps: update module go.uber.org/zap to v1.28.0 (#294) (5707197)
  • deps: update module golang.org/x/sys to v0.39.0 (#162) (3bdebfd)
  • deps: update module golang.org/x/sys to v0.40.0 (#191) (618f334)
  • deps: update module golang.org/x/sys to v0.41.0 (#213) (d4918c7)
  • deps: update module golang.org/x/sys to v0.42.0 (#259) (15965a3)
  • deps: update module golang.org/x/sys to v0.44.0 (#295) (e1610a9)
  • deps: update module golang.org/x/sys to v0.46.0 (#335) (f27c183)
  • deps: update module golang.org/x/term to v0.38.0 (#163) (897e30b)
  • deps: update module golang.org/x/term to v0.39.0 (#192) (e852a38)
  • deps: update module golang.org/x/term to v0.40.0 (#215) (2ec4b9b)
  • deps: update module golang.org/x/term to v0.41.0 (#260) (cb4e6b0)
  • deps: update module golang.org/x/term to v0.43.0 (#296) (f9c805d)
  • deps: update module golang.org/x/term to v0.44.0 (#336) (bb30315)
  • deps: update module sigs.k8s.io/controller-runtime to v0.23.0 (#200) (9f65c11)
  • deps: update module sigs.k8s.io/controller-runtime to v0.23.1 (#205) (9411851)
  • deps: update module sigs.k8s.io/controller-runtime to v0.23.3 (#248) (3eb8ce9)
  • deps: update module sigs.k8s.io/controller-runtime to v0.24.1 (#297) (e3d93d4)
  • deps: update module sigs.k8s.io/controller-runtime to v0.25.0 (#410) (004c95f)
  • deps: update module tailscale.com to v1.100.0 (#337) (4f7ef47)
  • deps: update module tailscale.com to v1.102.1 (#379) (8c0fe74)
  • deps: update module tailscale.com to v1.90.8 (#139) (69a3b3e)
  • deps: update module tailscale.com to v1.92.0 (#150) (6eaae56)
  • deps: update module tailscale.com to v1.92.1 (#158) (1caa044)
  • deps: update module tailscale.com to v1.92.2 (#166) (100c8d7)
  • deps: update module tailscale.com to v1.92.3 (#176) (0beb4a6)
  • deps: update module tailscale.com to v1.92.4 (#178) (8b484cf)
  • deps: update module tailscale.com to v1.92.5 (#188) (0f87341)
  • deps: update module tailscale.com to v1.94.0 (#194) (76686e2)
  • deps: update module tailscale.com to v1.94.1 (#202) (7db6972)
  • deps: update module tailscale.com to v1.94.2 (#225) (b446a39)
  • deps: update module tailscale.com to v1.96.1 (#261) (977368e)
  • deps: update module tailscale.com to v1.96.5 (#272) (e61d892)
  • deps: update module tailscale.com to v1.98.2 (#301) (c9bc4bb)
  • deps: update module tailscale.com to v1.98.3 (#310) (1a87d1c)
  • deps: update module tailscale.com to v1.98.5 (#317) (112f281)
  • deps: update opentelemetry-go monorepo to v1.42.0 (#262) (9819a8b)
  • deps: update opentelemetry-go monorepo to v1.43.0 (#302) (e00185d)
  • deps: update opentelemetry-go monorepo to v1.44.0 (#338) (fcc7046)
  • deps: update opentelemetry-go-contrib monorepo to v0.69.0 (#339) (90a9f11)
  • mise: downgrade pre-commit (572c307)
  • stamp the version into release binaries and sign releases with (fbe7344)

v0.2.2

Release notes

Bug Fixes

  • deps: update module golang.org/x/sys to v0.38.0 (#128) (cdb8147)
  • deps: update module golang.org/x/term to v0.37.0 (#130) (f4253e7)
  • deps: update module sigs.k8s.io/controller-runtime to v0.22.4 (#122) (1cdfc3b)
  • deps: update module tailscale.com to v1.90.4 (#110) (f248317)
  • deps: update module tailscale.com to v1.90.6 (#118) (e634606)

tailscale-k8s-auth: v0.2.0

Release notes

⚠ BREAKING CHANGES

  • Import path changed from pkg/tailscale to pkg/tshttp
  • Major package reorganization with new service layer abstraction

Features

  • api: add read and write timeout configurations for the server to enhance performance and reliability (3604793)
  • api: add retryAfterSeconds option to TKAServer for configurable API behavior (7585ea9)
  • api: define ApiRouteV1Alpha1 constant for API versioning and improve route setup (46a75b8)
  • auth: enhance ginAuthMiddleware to support options for tagged nodes and funnel requests (7ecb669)
  • cli: add configuration and flags management for CLI commands (febc455)
  • cli: add integration command for shell integration and enhance shell command for temporary Kubernetes access (c02f099)
  • cli: add PrintInfoIcon function to log informational messages with icons for better user feedback (46a75b8)
  • cli: add set command to allow users to set resources in TKA for better resource management (bb7e734)
  • cli: add signal forwarding and terminal resize support to tka shell (9214ee1)
  • cli: add support for Unix build tag and refactor shell command initialization (feda95a)
  • cli: enhance command help functionality with custom error messages and usage formatting (37e4fa8)
  • cli: enhance shell command support with instructions for bash, zsh, fish, and PowerShell (5613810)
  • cli: enhance shell command with context handling and signal management for better cleanup (b686fa6)
  • cli: introduce generate command to create resources in TKA for enhanced functionality (bb7e734)
  • cmd: implement root command structure for Tailscale Kubernetes Auth CLI with version command (46a75b8)
  • colors.go: add NoTTYStyle to support non-TTY environments for better user experience (f20a05f)
  • config: add configuration file for Tailscale and server settings (5be2f14)
  • configuration: Fix search path (b7a8f08)
  • docs: add "Configure Settings" section to documentation for TKA CLI settings management (c35bbec)
  • docs: add new getting started guide and CLI reference (9188776)
  • docs: add support for swagger.json in documentation workflow to ensure API documentation is up-to-date (bb7e734)
  • docs: enhance CLI documentation generation with front matter options (c73e54d)
  • docs: enhance documentation command to fix markdownlint errors for improved documentation quality (bb7e734)
  • docs: enhance README and architecture documentation with new fe… (#26) (9188776)
  • docs: enhance README and architecture documentation with new features and guides (37e4fa8)
  • docs: implement config command to get and set configuration values in TKA configuration file for better user experience (bb7e734)
  • o11y: add better o11y (200a965)
  • operator: refactor operator configuration to use OperatorOptions struct for better organization and flexibility (7585ea9)
  • orchestrator: Add stubs for orchestrator (a799479)
  • tailscale.Server: add support for TLS and Funnel protocols in Tailecale server (#67) (1526960)
  • tailscale: make Server http.Server-compatible and decouple auth (450b9cc)
  • tailscale: split generic listener-backed http.Server (5676951)
  • utils: add InitObservability function to initialize logging and tracing for better observability in the application (46a75b8)

Bug Fixes

  • api: enforce minimum validity period for Kubernetes tokens in login.go (7585ea9)
  • api: improve error handling in login and logout handlers to provide clearer feedback on failures (bb7e734)
  • api: update Retry-After header to use configurable retryAfterSeconds value (7585ea9)
  • auth only a sub-group of the API (197d12d)
  • build.yaml: update artifact paths for ARM and AMD builds to reflect correct directory structure (b102a30)
  • cli: update kubeconfig command to detect shell type and generate appropriate export statements for better usability (bb7e734)
  • colors.go: improve IsTerminal function to handle "dumb" terminal case correctly (f20a05f)
  • deps: update dependency swagger-ui-dist to v5.29.0 (#58) (eaa7475)
  • deps: update github.com/sierrasoftworks/humane-errors-go digest to 2224f06 (#40) (e2ca494)
  • deps: update github.com/sierrasoftworks/humane-errors-go digest to 431bf8b (#38) (5d5c0ed)
  • deps: update kubernetes packages to v0.34.1 (#63) (a789665)
  • deps: update module github.com/charmbracelet/bubbletea to v1.3.10 (#55) (9b7105d)
  • deps: update module github.com/gin-gonic/gin to v1.11.0 (#66) (c24481f)
  • deps: update module github.com/spechtlabs/go-otel-utils/otelzap to v0.0.15 (#57) (343c831)
  • deps: update module github.com/spf13/pflag to v1.0.7 (#33) (a8cc0a5)
  • deps: update module github.com/spf13/viper to v1.21.0 (#54) (35f5d2b)
  • deps: update module github.com/swaggo/files to v2 (#29) (135c51f)
  • deps: update module github.com/swaggo/files to v2 (#51) (adc24e2)
  • deps: update module golang.org/x/sys to v0.37.0 (#85) (9bc89a8)
  • deps: update module golang.org/x/term to v0.35.0 (#52) (5793c51)
  • deps: update module golang.org/x/term to v0.36.0 (#91) (e418857)
  • deps: update module sigs.k8s.io/controller-runtime to v0.22.1 (#53) (aa83a74)
  • deps: update module sigs.k8s.io/controller-runtime to v0.22.2 (#83) (02bd469)
  • deps: update module sigs.k8s.io/controller-runtime to v0.22.3 (#89) (13ccbee)
  • deps: update module sigs.k8s.io/yaml to v1.6.0 (#37) (a32e3bc)
  • deps: update module tailscale.com to v1.88.3 (#59) (4da3333)
  • deps: update module tailscale.com to v1.88.4 (#95) (a35934b)
  • deps: update module tailscale.com to v1.90.0 (#99) (ed618b7)
  • deps: update module tailscale.com to v1.90.2 (#100) (96d6169)
  • docs: correct command references in shell integration and troubleshooting guides (c35bbec)
  • docs: fix urls in navbar (9c82333)
  • docs: update autocompletion documentation to reflect command changes (c35bbec)
  • GitHub Action didn't run on main anymroe (06010ba)
  • goreleaser: fix goreleaser build (f93facd)
  • goreleaser: fix goreleaser build (0d6a2a9)
  • health endpoint (86bd54b)
  • health endpoint (44b4339)
  • options.go: auto-detect NoColor option based on NO_COLOR environment variable or non-TTY (f20a05f)
  • options.go: update DefaultOptions to use NoTTYStyle when not in a TTY (f20a05f)
  • pretty_helptext.go: correct typo in markdown alert replacement from IMORTANT to IMPORTANT (f20a05f)
  • pretty_helptext.go: handle template parsing errors gracefully instead of panicking (f20a05f)
  • pretty_print: ensure error messages are printed to stderr for visibility (7592648)
  • publish workflow (77827ef)
  • tailscale/server.go: update address assignment to use HTTPS for port 443 (3db24e1)
  • try to resolve the real public cluster address (ec8b753)

Code Refactoring

  • rename tailscale package to tshttp (11c1ae9)
  • restructure pkg/ architecture with clean layered design (d90dbe0)

Contributors

Your contributions matter. Here's to everyone who's helped bring this to life.