How I Use Tailscale
Every app has a tailnet hostname here, and every one of them resolves to the edge. Nothing on this tailnet can see a backend directly, because no backend is on it.
Terminates TLS and looks the hostname up in the configuration ConfigFS delivers. The backend it finds is a VIP on the other tailnet, dialled through a tsnet node embedded in Traefik. Nothing flows the other way.
A stable address the edge dials, created by Pulumi with the app's tags. Grants name the service, so the edge may reach it and nothing else may. Whichever pods are alive answer for it.
A tailscaled sidecar tsinject injected, joined with the workload's own OAuth client. It advertises the VIP with tailscale serve and leaves the tailnet when the pod dies.
Same identity, same tags: all replicas of a Deployment share one OAuth client. A rollout is nodes leaving and arriving behind an address that never changes.
How a workload joins
inject-tailscale: "true", and tailscale-tags: plex, media. Nothing else changes: no sidecar in the manifest, no Secret to make, no tailnet to know about.
Adds the tailscaled container, its volumes and its environment from the annotations, and stamps the pod with its identity: the shared name, else the Deployment's. It calls nothing. If the credential already exists the pod schedules at once; the first pod of a workload is admitted behind a scheduling gate and sits visibly SchedulingGated.
A TailscaleCredential named for the identity and owned by the Deployment, the serve and config ConfigMaps, and RBAC for the tailscaled state Secret. Then it waits for Ready.
One per workload, carrying the tags plus tag:injected, minted in whichever tailnet the annotation names. Delivered as a Secret, tags updated in place when they drift, revoked by a finalizer when the credential goes.
Shares the pod's network namespace, so the tailnet is just another interface it can listen on.
Joins with the Secret as its auth key and advertises the tags. Ephemeral if asked; kernel networking even under Kata, through a tun device the runtime provides.