Deploys the Tailscale Kubernetes operator with OIDC workload identity or an OAuth client secret. The operator registers services in your Tailnet, enabling private access to databases, caches, and other cluster resources from devices on your Tailnet.
Prerequisites: configure Tailscale access controls and create an OIDC trust credential or OAuth client. For OIDC, the cluster's service account issuer must be publicly accessible. See the operator installation guide and workload identity guide.
This blueprint accepts 6 configurable inputs to customize the installation for your environment.
authMethodstringUse the operator's Kubernetes service account token or an OAuth client secret.
oidcClientIdstringClient ID generated by the Tailscale OIDC trust credential.
oidcAudiencestringAudience generated by the Tailscale OIDC trust credential.
clientIdstringTailscale OAuth client ID.
clientSecretstringTailscale OAuth client secret.
externalHostsmapHosts outside the cluster to expose on your Tailnet as `<name>-<environment>`. The host must be reachable from the environment's VPC. Example: `analytics` → `mydb.abc123.us-east-1.rds.amazonaws.com` is reachable as `analytics-prod`.
This blueprint exposes 1 output that other services can reference.
namespacestringKubernetes namespace where the operator is deployed.