Ephemeral Castle Tailscale Bridge

The Tailscale Bridge integrates immutable Talos Linux nodes into the private mesh.

Technical Details

Uses the Talos system-extension model together with short-lived AuthKeys minted during the rebirth flow.

  • Talos nodes receive Tailscale bootstrap material during the Proxmox/Talos creation path.
  • The patching step is driven by create.sh after the platform layer succeeds.
  • The AuthKey is generated in memory and is not meant to be persisted into Terraform state.
  • The bridge patch applies ExtensionServiceConfig with TS_EXTRA_ARGS=--advertise-tags=tag:tazlab-k8s --accept-routes=false and TS_STATE_DIR=/var/lib/tailscale.
  • The same patch also narrows kubelet node-IP selection so node identity stays on the lab subnet while the node OS still carries Tailscale traffic.

Connectivity Model

This bridge matters because the operator often runs Tailscale from inside TazPod, where userspace networking can change how reachability works.

In practice, the bridge ensures that cluster nodes still become manageable over the mesh even when the operator path is using the TazPod Nomadic Workflow and a userspace-networked Tailscale client.

For cluster workloads, the bridge currently provides raw pod egress to tailnet IPs through the node OS path, but it does not by itself provide workload DNS for MagicDNS hostnames.

Verified Connectivity

On 2026-04-27 the following was verified with the Vault node (current FQDN lushycorp-vault.magellanic-gondola.ts.net, tailnet IP 100.82.13.87 after 2026-04-30 recreate):

  • a pod in external-secrets could open TCP to 100.82.13.87:8200
  • HTTPS to Vault succeeded from a pod when using explicit SNI/host mapping: curl -k --resolve lushycorp-vault.magellanic-gondola.ts.net:8200:100.82.13.87 https://lushycorp-vault.magellanic-gondola.ts.net:8200/v1/sys/health
  • plain pod DNS resolution of the old custom alias lushycorp-api.ts.tazlab.net did not point to the tailnet target

The follow-up code review confirmed that the native Tailscale-owned identity is the device hostname lushycorp-vault.magellanic-gondola.ts.net, while lushycorp-api.ts.tazlab.net was a Vault runtime alias defined outside the Tailscale layer. The preferred architectural direction is to converge the Vault contract onto the native MagicDNS hostname.

See Also