feat: client-only mode (join external headscale) - #32
Merged
Conversation
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The prose belongs in README.md.gotmpl; helm-docs renders README.md from it, so the earlier directly-edited section was clobbered on regeneration. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Long defaults (JSON objects, paths, URLs) have no spaces and were wrapped in a backtick code span, so they could not wrap and forced the Default column wide, starving the Description column on GitHub. Render defaults in <code> with <wbr> break opportunities (zero-width) so the cell wraps. Done via a chart.valuesSection override in README.md.gotmpl. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
One reusable, long-lived key for the whole cluster (not per node). Explain the node-key-expiry vs key-expiry distinction and why tagging the key (with a matching tagOwners ACL entry) keeps nodes enrolled indefinitely. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
server.enabled(defaulttrue). Whenfalse, the chart deploys only the Tailscale client and joins an external headscale — no local server. This covers the use case of joining another cluster's headscale (the Tailscale Kubernetes operator is incompatible with headscale).--login-serverfromclient.loginServer, its preauth key fromclient.authKey(chart creates the Secret) orclient.authKeySecret(existing Secret), and optional TLS trust viaclient.caSecretName(empty → system CA bundle, covers Let's Encrypt).server.enabled.fail) enforces the two modes are mutually exclusive: external-mode values are forbidden whenserver.enabled=true, and required/consistent whenfalse.Backward compatibility
Existing installs omit
server:→ defaults toenabled: true→ no change.values.schema.jsonupdated for the new keys.Test plan
helm lint+ default and externalhelm template(new CI step inlint.yaml).hack/kind-smoke.sh --with-external-client: stands up a server release, mints a real preauth key, then a separate client-only release that joins it over cross-namespace Service DNS — asserts no server resources in the client namespace, client DaemonSet ready, client state secret created, and the server registers the node.--with-client) still passes (init container, policy, idempotency).Design + plan:
docs/superpowers/specs/2026-06-10-client-only-external-server-design.md,docs/superpowers/plans/2026-06-10-client-only-external-server.md.🤖 Generated with Claude Code