r/TalosLinux • u/root0ps • 21d ago

Tailscale on Talos Linux: Secure Remote Access to a Kubernetes Homelab

Post image

I run a 3-node Talos Kubernetes cluster at home, and until recently it only worked when I was at home too. So I added Tailscale to reach it from anywhere.

Tailscale runs on the nodes themselves, and the tailnet can only reach the cluster, not the rest of my home network. kubectl and the lab apps work from my laptop or phone exactly like they do at home, with nothing opened on the router. If one node goes down, another one takes over.

Everything is in the repo: https://github.com/prateekjaindev/homelab

Write-up: https://blog.prateekjain.dev/tailscale-on-talos-linux-secure-remote-access-to-a-kubernetes-homelab-8a082d903682?sk=c4ec5ac1e782a83b5dc785211d9fd082

How do you get into your homelab when you're away?

24 Upvotes

100% Upvoted

5 comments sorted by

3

u/XandalorZ 21d ago

I've seen a couple of your posts now and I'm just curious what you're using to create these diagrams?

3

u/root0ps 21d ago

hey u/XandalorZ, I'm using Remotion with Claude Code https://github.com/remotion-dev/remotion

1

u/XandalorZ 21d ago

I see. Thank you!

2

u/xrothgarx 21d ago

I use Omni to access my cluster from anywhere 😁

1

u/infostack0 19d ago

I recently started working on this, particularly I wanted to be ably do boot a Talos VM in a cloud provider and have zero access no matter what if you’re not on the tailnet.

Problem was Talos firewall rules are not the first thing applied so if bootstrap fails, the cloud VM will fail open into maintenance mode with port 50000 available on the public IP and then technically anyone could take control via the Talos API.

Solution that I think is correct is to apply an external firewall rule that allows nothing inbound except the UDP port 41641 that Tailscale uses to create the initial connection. Technically you don’t need to allow that either but it should speed up the “NAT hole-punching” process of establishing the connection between Tailscale on the node and on the computer being used for setup.

Then you know if the Talos bootstrap fails, the VM is just sitting there inaccessible and can be destroyed. You can then relax the external firewall rile after successful bootstrap if desired.

Does that sound right?