https://articles.maximemoreillon.com/tags/tailscale/ Recent content in Tailscale on Maxime Moreillon Hugo -- gohugo.io en-us Sat, 10 Oct 2026 12:31:20 +0900 https://articles.maximemoreillon.com/articles/envoy-tailnet-only/ Sat, 10 Oct 2026 12:31:20 +0900 https://articles.maximemoreillon.com/articles/envoy-tailnet-only/ <p>Some services in my Kubernetes cluster, like HashiCorp Vault, should only be reachable from devices on my <a href="https://tailscale.com/">Tailscale</a> tailnet. They used to be exposed through NodePorts on the node&rsquo;s Tailscale IP, which works but means remembering port numbers. This article shows how to give them proper hostnames through <a href="https://gateway.envoyproxy.io/">Envoy Gateway</a> while keeping them off the internet and the LAN.</p> <p>Three pieces are involved:</p> <ul> <li><strong>Cloudflare DNS</strong>: a public record pointing at the node&rsquo;s Tailscale IP</li> <li><strong>Tailscale</strong>: split DNS, so devices can resolve that record wherever they are</li> <li><strong>Envoy Gateway</strong>: a dedicated listener, restricted by client IP</li> </ul> <h2 id="cloudflare-a-dns-only-record">Cloudflare: a DNS-only record</h2> <p>In the Cloudflare dashboard, create an <code>A</code> record for a wildcard under a dedicated subdomain, pointing at the Tailscale IP of the Kubernetes node:</p>