Tailscale K8s Auth

Appearance

Shell Integration Setup

About 750 wordsAbout 3 min

2025-01-27

Set up seamless shell integration so tka login automatically updates your shell environment without manual export commands.

Overview

By default, TKA cannot modify your shell's environment variables because subprocesses cannot change the parent shell's state. Shell integration solves this by installing a wrapper function that intercepts TKA commands and automatically evaluates environment exports.

Supported Shells

  • Bash
  • Zsh
  • Fish
  • PowerShell

Installation

  1. Generate Integration Code

    First, generate the shell integration code for your shell:

    tka generate integration [bash|zsh|fish|powershell]

  2. Install Integration

    bash

    Add to your shell's configuration file:

    # add to ~/.bashrc or ~/.bash_profile
eval "$(tka generate integration bash)"

    Then reload your shell:

    source ~/.bashrc

Usage After Integration

Once installed, TKA commands work seamlessly:

Automatic Environment Updates

Before

Before integration (manual)
$ tka login
✓ sign-in successful!
    ╭───────────────────────────────────────╮
    │ User:  [email protected]              │
    │ Role:  cluster-admin                  │
    │ Until: Mon, 27 Jan 2025 18:30:00 CET  │
    ╰───────────────────────────────────────╯
✓ kubeconfig written to: /tmp/kubeconfig-123456.yaml
→ To use this session, run: export KUBECONFIG=/tmp/kubeconfig-123456.yaml

$ export KUBECONFIG=/tmp/kubeconfig-123456.yaml

$ kubectl get pods
...

After

After integration (automatic)
$ tka login
# Your KUBECONFIG is automatically set!

$ kubectl get pods
# Works immediately

Note

The shell integration is roughly equal to

eval "$(command ts-k8s-auth login --quiet)"

To learn more, I encourage you to checkout the source code or check out the Developer Documentation: Shell Integration Details

Supported Commands

The wrapper automatically handles these commands:

  • tka login - Sets $KUBECONFIG after successful authentication
  • tka refresh / tka reauthenticate - Updates $KUBECONFIG with refreshed credentials
  • tka logout - Unsets $KUBECONFIG and cleans up temp files

Bypass Integration

To see full output without environment updates:

tka login --no-eval

This shows the traditional output with manual export instructions.

Troubleshooting

Integration Not Working

  1. Verify Installation:

    type tka  # Should show it's a function, not a binary

  2. Check Path:

    which tka  # Should show the binary path

  3. Reload Shell:

    source ~/.bashrc  # or your shell's config file

Multiple TKA Installations

If you have multiple TKA binaries:

# Specify full path in integration
eval "$(/usr/local/bin/tka generate integration bash)"

Permission Issues

Ensure the TKA binary is executable:

chmod +x /path/to/tka

Environment Not Updating

  1. Check Integration Code: Re-run the integration command to see if there are syntax errors
  2. Manual Test: Try tka login --no-eval and manually export the KUBECONFIG
  3. Shell Compatibility: Ensure you're using a supported shell version

Fish-Specific Issues

Fish uses different syntax. If you see errors:

# Check Fish version
fish --version

# Verify integration code works
tka generate integration fish | fish_indent

PowerShell-Specific Issues

For PowerShell execution policy issues:

# Check execution policy
Get-ExecutionPolicy

# If needed, set policy (run as administrator)
Set-ExecutionPolicy RemoteSigned

Advanced Configuration

Custom Wrapper Location

Store the wrapper in a custom location:

# Generate and save wrapper
tka generate integration bash > ~/.local/share/tka/wrapper.sh

# Source from your shell config
source ~/.local/share/tka/wrapper.sh

Conditional Loading

Load integration only when TKA is available:

# In ~/.bashrc or ~/.zshrc
if command -v tka >/dev/null 2>&1; then
    eval "$(tka generate integration bash)"  # or zsh
fi

Multiple Environments

For different TKA configurations per project:

# Project-specific wrapper
alias tka-prod='TKA_TAILSCALE_TAILNET=prod.ts.net tka'
alias tka-dev='TKA_TAILSCALE_TAILNET=dev.ts.net tka'

Uninstalling Integration

Remove from Shell Config

  1. Edit your shell configuration file

  2. Remove or comment out the integration line:

    # eval "$(tka generate integration bash)"

  3. Reload your shell

Clean Up Temporary Files

# Remove any remaining temp kubeconfig files
rm -f /tmp/kubeconfig-*.yaml

# Unset environment variables
unset KUBECONFIG

Security Considerations

  • The wrapper only evaluates specific TKA output patterns
  • Temporary kubeconfig files are created with restricted permissions (600)
  • Integration code can be reviewed before installation
  • No sensitive data is stored in shell history

Next Steps