vitobotta/hetzner-k3s v2.11.0

on GitHub

New

• Tailscale integration. hetzner-k3s can install Tailscale on every node during provisioning and join the nodes to your tailnet, so SSH, the generated kubeconfig and the Kubernetes API work over MagicDNS names instead of public IPs. Enable it with networking.tailscale.enabled: true, set hostname_suffix to your MagicDNS domain, and supply an auth key through auth_key or TAILSCALE_AUTH_KEY. networking.tailscale.version pins the package version. (#787) - by @marcioecom
• Tailscale installs from Tailscale's signed apt or dnf repository rather than the upstream install script. An image without a supported package manager stops during boot with a message in /var/log/hetzner-k3s.log, and a machine that cannot reach the tailnet fails at once instead of retrying for five minutes.
• The API server certificate includes a TLS SAN for each master's tailnet name, and allowed_networks current-IP validation is skipped while Tailscale is enabled, so a public allowlist does not need to track your laptop. The full setup and the cleanup caveats are in the new Tailscale integration documentation page.

Upgrading

No action is required. The networking.tailscale block is optional and defaults to enabled: false, so existing configurations and clusters behave as before. The boot step is gated on that flag, so nodes are only touched when you turn the feature on.

No bundled addon pins changed in this release: the CCM, CSI, system upgrade controller and cluster autoscaler versions are the same as in v2.10.0.

If hetzner-k3s is useful to you or your company, please consider sponsoring its development.
Sponsorship helps ensure continued maintenance and new features. Thank you to our current sponsors! 🙏