Tailscale Vpn

# Overview

ArgoCD and future internal tools sit behind an internal ALB, unreachable from the public internet.

We’ll integrate Tailscale in the stack as a lightweight VPN layer to access the private VPC network without managing a separate VPN endpoint or certificate authority.

# Components

Here are the Tailscale components we’ll use to access the internal endpoints of our EKS cluster:

- **Tailnet:** private Tailscale network where we can add users, devices, and resources.
- **Access Control (ACL):** tailnet-wide network policies to define access control to our components.
- **Subnet Router** (Connector CRD)**:** adds the VPC where EKS runs as a device to our telnet.
- **Split DNS:** routes DNS queries to your private domain [`yourdomain.com`](http://argocd.dev.yourdomain.com) to the VPC’s DNS
- **Tailscale Kubernetes Operator:** runs inside EKS and manages the subnet router lifecycle via a Kubernetes CRD
- **Workload Identity Federation:** allows CI to authenticate to Tailscale without storing long-lived secrets in GitHub

# Prerequisite

Create an account and login to https://login.tailscale.com/admin/welcome

Download the tailscale client https://tailscale.com/download/macos

Copy the example environment file: