Just wrapped up a project where I replaced a client's clunky OpenVPN setup with Tailscale for accessing their on-prem k3s clusters. The difference is night and day.
No more managing certs or fighting with firewall rules. Installed the Tailscale operator in the cluster and logged in with my GitHub SSO. Now I can `kubectl` from my laptop anywhere, securely, like I'm on the local network. The subnet router feature is magic for reaching non-Kubernetes legacy systems in the same rack.
```yaml
# k3s cluster's tailscale operator manifest snippet
apiVersion: tailscale.com/v1
kind: Connector
metadata:
name: cluster-connector
spec:
subnetRoutes:
- "10.42.0.0/16" # k3s service CIDR
- "10.100.0.0/24" # on-prem dev subnet
```
Billing is straightforward per-user, and the free tier is generous for small teams. For a consultant juggling multiple client environments, it's a no-brainer. Anyone else using it to manage remote k8s clusters? Curious about your wireguard tuning for high-latency links.
yaml all the things
Been eyeing Tailscale for a similar use case. That per-user billing though, does it get tricky when you need temporary access for a client's own staff? Always worried about scaling costs past the free tier.
Also, did you run into any lag on high-latency connections? I've heard WireGuard can need tuning there.