Troubleshooting and Next Steps
About 208 words
If something isn't working, check our troubleshooting guide(Open in new window) for common issues:
- 403 errors: Ensure you're on the tailnet, not using Funnel
- 400 capability errors: Check for multiple or malformed ACL rules
- Connection issues: Verify Tailscale connectivity and DNS
- RBAC errors: Ensure the role in your ACL exists in Kubernetes
Next Steps
Now that TKA is working:
- Production Setup: Follow the production deployment section in the comprehensive guide
- Shell Integration: Set up automatic environment updates(Open in new window)
- Multi-cluster: Configure multiple clusters(Open in new window)
- Advanced ACLs: Learn more about ACL configuration(Open in new window)
Understanding What Happened
TKA just demonstrated a complete zero-trust authentication flow:
- Network Authentication: Your request came via the Tailscale network
- Identity Resolution: TKA identified you via Tailscale WhoIs
- Capability Check: Your ACL grants were validated
- Resource Provisioning: A ServiceAccount and RBAC were created
- Token Generation: A short-lived token was issued
- Access Granted: You could use kubectl with proper permissions
- Cleanup: Resources were removed when you logged out
This provides ephemeral, auditable access without permanent credentials or complex OIDC integrations.