Private services via Tailscale¶

Some namespaces run a Tailscale proxy that forwards connections to internal services such as PostgreSQL and Grafana. This gives you private network access without needing a public endpoint or kubectl port forwarding.

Connect¶

Install the Tailscale client and ask an administrator how to sign in and get access to the services you need. Once connected, use the device's hostname and port in your browser or database client.

Device names such as k8s-trackpac are connection addresses. Tags such as tag:k8s-trackpac are used in access policies. Access can be limited to specific devices and ports; Kubernetes permissions and Tailscale access are managed separately.

Find service addresses and ports¶

Check deployments/<namespace>/tailscale-proxy/deployment.yaml in the relevant repository:

TS_HOSTNAME gives the device name. In the ConfigMap's serve.json, the keys under TCP are the ports you connect to; TCPForward identifies the internal service they reach.

For example, PostgreSQL in Trackpac's monitoring namespace exposes Grafana which is available at trackpac-monitoring:3000. Simply log in with your Authentik credentials to access it.

Tailscale provides the network connection; you still need the application's login or database credentials. Switching kubectl contexts does not change which service these addresses reach.

If a connection fails, check that Tailscale is connected and you are using the correct hostname and port. If the name does not resolve, try the device's Tailscale IP. Ask an administrator to check your network access if the connection still fails.