Tailscale on Talos (Day 38)

Tailscale Extension

First, add the Tailscale system extension to your Talos configuration:

# extensions.yaml
customization:
  systemExtensions:
    officialExtensions:
      - siderolabs/tailscale

Build a custom Talos image with the extension:

# Generate custom image with Tailscale extension
curl -X POST --data-binary @extensions.yaml https://factory.talos.dev/schematics

# Returns a schematic ID like: 8cdf4cd0a3a9fa4771aab65437032804940f2115b1b1ef6872274dde261fa319

Upgrade your Talos nodes to use the custom image:

# Upgrade node with the new image (talosctl manages the Talos OS lifecycle)
talosctl upgrade --preserve --nodes 10.30.30.155 \
  --image factory.talos.dev/installer/8cdf4cd0a3a9fa4771aab65437032804940f2115b1b1ef6872274dde261fa319:v1.10.4

Tailscale Configuration

Configure Tailscale with your auth key (SOPS-encrypted for security):

# tailscale-config.yaml (decrypted view)
apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: tailscale
environment:
    - TS_AUTHKEY=tskey-auth-<your-key-here>  # Your Tailscale auth key
    - TS_EXTRA_ARGS=--accept-routes --reset  # Accept subnet routes and reset on conflicts

Apply the configuration to your node:

# Patch machine config to add Tailscale configuration
talosctl -n 10.30.30.155 -e 10.30.30.155 patch mc -p @tailscale-config.yaml

After applying, Tailscale will start automatically and connect your Talos node to your tailnet. The node will appear in your Tailscale admin console with its hostname.

SOPS Encryption

The actual tailscale-config.yaml is SOPS-encrypted to protect the auth key:

# Encrypt your config
sops -e tailscale-config.yaml > tailscale-config.enc.yaml

# Decrypt when applying
sops -d tailscale-config.enc.yaml | talosctl -n <node> patch mc -p -

This keeps the Tailscale auth keys secure when checked in on git.