Learn to set up TKA in a Kubernetes cluster and authenticate using your Tailscale identity.

What You'll Build

By the end of this tutorial:

• TKA server running in your Kubernetes cluster
• Ephemeral kubeconfig issued for your user
• RBAC bound to the role defined in your ACL capability
• Automatic credential cleanup on logout

Prerequisites

Essential:

• Kubernetes cluster you can reach (kind, k3s, existing cluster, etc.)
• Tailscale account with your device joined to the tailnet
• kubectl installed

For HTTPS (recommended):

• HTTPS enabled in your tailnet
• Tailscale authentication key

Optional:

• Docker or Podman (for creating test cluster)
• Go 1.21+ (for building from source)

Edit this page

Previous pageOverview

Next pageQuick Start