- Published
- Author
- Satya
Expose a Kubernetes cluster workload to the public internet using Tailscale Funnel.
Our cluster is tailnet-only (nothing public), which breaks inbound webhooks , e.g. Slack Event Subscriptions can't reach a private host.
Funnel (via the Tailscale k8s operator) exposes a single endpoint publicly over HTTPS at
It's just an Ingress:
Useful for: Slack/GitHub/Stripe webhooks, OAuth callbacks, demo links , expose one path, no public LB, no firewall hole.
Gotcha: needs funnel enabled in the tailnet ACL.
Link: https://tailscale.com/docs/kubernetes-operator/ingress/expose-workload-to-internet|tailscale.com/docs/kubernetes-operator/ingress/expose-workload-to-internet
#tailscale #k8s-cluster #slack
Our cluster is tailnet-only (nothing public), which breaks inbound webhooks , e.g. Slack Event Subscriptions can't reach a private host.
Funnel (via the Tailscale k8s operator) exposes a single endpoint publicly over HTTPS at
https://<name>.<tailnet>.https://ts.net|ts.net cert auto-provisioned, everything else stays private + outbound-only.It's just an Ingress:
Code
annotations: { https://tailscale.com/funnel|tailscale.com/funnel: "true" }
ingressClassName: tailscaleUseful for: Slack/GitHub/Stripe webhooks, OAuth callbacks, demo links , expose one path, no public LB, no firewall hole.
Gotcha: needs funnel enabled in the tailnet ACL.
Link: https://tailscale.com/docs/kubernetes-operator/ingress/expose-workload-to-internet|tailscale.com/docs/kubernetes-operator/ingress/expose-workload-to-internet
#tailscale #k8s-cluster #slack