Skip to content

Private clusters

kubelatch needs to reach the API server of every cluster it manages over https. If the API server is private (an EKS with a private endpoint, a k3s in an office), here are your options for reaching it.

kubelatch has no relay of its own and no tunnel-specific support in the code. It uses your organization's network.

flowchart LR
  P[People and CI] -->|https| K[kubelatch<br/>management cluster]
  K -->|tunnel or VPN| A[Private API server]

The options

Option How When
VPN or peering Joins the management cluster's network with the private cluster's. The simplest option if it already exists.
Tailscale The Tailscale operator on the private cluster exposes the API server: tailscale up --advertise-routes on a node, or a ProxyGroup/Connector. kubelatch runs with a tailscale sidecar, or the management cluster is on the tailnet. If you already use Tailscale. The kubelatch namespace applies the restricted Pod Security Admission level: a sidecar that asks for privileges (for example NET_ADMIN) won't start there.
Cloudflare Tunnel Only the network tunnel (WARP Connector or private networks), which gives IP reachability to the API server. If you already use Cloudflare Zero Trust.

Application-level Cloudflare Tunnel doesn't work

Publishing the API server as a Cloudflare Access application requires an Access service token on every request. kubelatch can't add that header, so its requests to the cluster would be rejected.

Register the cluster through the tunnel

Registration is the usual one (Register a cluster), with one difference: the server you paste is the one kubelatch can reach, not the one your kubectl uses.

  1. Apply the bootstrap and run the one-liner as usual.
  2. Before pasting the JSON, change server to the API server address as seen from kubelatch. With Tailscale, the one that resolves over the tailnet.
  3. Leave ca as is: the API server's CA doesn't change.
  4. Paste the JSON and click Guardar tokens (Save tokens).

The URL only accepts https and never a literal link-local, metadata, or multicast IP (names aren't resolved to check this).

Check that it works

  • The cluster switches to Listo (Ready) in Clusters.
  • Namespaces lists the cluster's namespaces.
  • A request through the proxy works. If the proxy responds 502 with no se pudo hablar con el API server del cluster (couldn't talk to the cluster's API server), kubelatch can't reach the registered server: check the tunnel and the routes from the management cluster. The full error is in kubelatch's log.