### Deploying Component via Atmos Catalog

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Configuration example for deploying the aws-eks-tailscale component using an Atmos stack YAML file. Set `stack_level: regional` and override catalog defaults with `vars`.

```yaml
components:
  terraform:
    eks/tailscale:
      vars:
        enabled: true
        name: tailscale
        region: us-east-2
        create_namespace: true
        kubernetes_namespace: "tailscale"
        image_repo: tailscale/k8s-operator
        image_tag: unstable
        eks_component_name: "eks/cluster"
        routes:
          - "10.0.0.0/8"
        tags:
          Team: platform
          Environment: prod
```

--------------------------------

### Run All Terraform Tests with Atmos

Source: https://github.com/cloudposse-terraform-components/aws-eks-tailscale/blob/main/README.md

Execute all defined Terraform tests using the Atmos command-line tool. Ensure Atmos is installed and configured.

```bash
atmos test run
```

--------------------------------

### Configure Cloud Posse Label Context for EKS Tailscale

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Define standard resource naming and tagging using the Cloud Posse null-label context. This example shows typical inputs for a production deployment, including namespace, environment, stage, name, and custom tags.

```hcl
# Typical context inputs for a production deployment
module "eks_tailscale" {
  source = "..."

  # Context inputs — compose the resource ID: "cp-ue2-prod-tailscale"
  namespace   = "cp"           # org abbreviation
  environment = "ue2"          # us-east-2
  stage       = "prod"
  name        = "tailscale"
  attributes  = []             # optional suffix elements

  delimiter       = "-"        # default
  label_key_case  = "title"    # tag key casing: Title, lower, or UPPER
  label_value_case = "lower"   # tag value casing

  tags = {
    Team      = "platform"
    CostCenter = "infra"
  }

  # Suppress all auto-generated tags
  # labels_as_tags = []
}

# Access the computed ID and tags anywhere via module.this
# module.this.id      => "cp-ue2-prod-tailscale"
# module.this.tags    => { Namespace = "cp", Environment = "ue2", Stage = "prod", Name = "cp-ue2-prod-tailscale", Team = "platform", CostCenter = "infra" }
# module.this.enabled => true
```

--------------------------------

### Minimal Direct Terraform Usage

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Example of using the aws-eks-tailscale module directly in Terraform without Atmos. Required variables `region` and `kubernetes_namespace` are shown, along with several optional overrides.

```hcl
# Minimal direct Terraform usage (without Atmos)
module "eks_tailscale" {
  source = "github.com/cloudposse-terraform-components/aws-eks-tailscale//src"

  # Required
  region               = "us-east-2"
  kubernetes_namespace = "tailscale"

  # Optional — override defaults
  enabled             = true
  name                = "tailscale"
  namespace           = "cp"
  environment         = "ue2"
  stage               = "prod"
  eks_component_name  = "eks/cluster"
  create_namespace    = true
  deployment_name     = "tailscale-operator"  # defaults to "tailscale-operator" if null
  image_repo          = "tailscale/k8s-operator"
  image_tag           = "unstable"
  routes              = ["10.0.0.0/12", "172.16.0.0/12"]

  tags = {
    Team        = "platform"
    ManagedBy   = "terraform"
  }
}
```

--------------------------------

### Atmos CLI Commands for Component Management

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Demonstrates common Atmos CLI commands for applying, planning, and destroying the `eks/tailscale` component within a specific stack.

```bash
# Apply the component to a specific stack
atmos terraform apply eks/tailscale --stack=ue2-prod

# Plan first
atmos terraform plan eks/tailscale --stack=ue2-prod

# Destroy
atmos terraform destroy eks/tailscale --stack=ue2-prod
```

--------------------------------

### Explore Additional Atmos Test Options

Source: https://github.com/cloudposse-terraform-components/aws-eks-tailscale/blob/main/README.md

View available options and commands for running Terraform tests with Atmos. This command provides help on customizing test execution.

```bash
atmos test --help
```

--------------------------------

### Kubernetes Namespace Creation with Labels

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Optionally creates the Kubernetes namespace for Tailscale, applying Cloud Posse label tags. Controlled by the `create_namespace` variable.

```hcl
resource "kubernetes_namespace" "default" {
  count = local.create_namespace ? 1 : 0  # enabled when module is enabled

  metadata {
    name   = var.kubernetes_namespace   # e.g. "tailscale"
    labels = module.this.tags           # Cloud Posse label tags
  }
}

# Check namespace after apply
# kubectl get namespace tailscale --show-labels
```

--------------------------------

### Configure EKS Tailscale Component

Source: https://github.com/cloudposse-terraform-components/aws-eks-tailscale/blob/main/src/README.md

Use this YAML configuration to enable and customize the EKS Tailscale component. Set parameters like image repository, tag, and namespace creation.

```yaml
components:
  terraform:
    eks/tailscale:
      vars:
        enabled: true
        name: tailscale
        create_namespace: true
        kubernetes_namespace: "tailscale"
        image_repo: tailscale/k8s-operator
        image_tag: unstable
```

--------------------------------

### Discover EKS Cluster and Subnets for Tailscale Routes

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Uses Atmos remote state to discover EKS cluster outputs and fetches VPC subnet CIDRs to build Tailscale subnet routes. Requires `cloudposse/stack-config/yaml//modules/remote-state`.

```hcl
# src/remote-state.tf
module "eks" {
  source  = "cloudposse/stack-config/yaml//modules/remote-state"
  version = "1.8.0"

  component = var.eks_component_name  # default: "eks/cluster"
  context   = module.this.context
}

# Automatically discover EKS cluster details
data "aws_eks_cluster" "kubernetes" {
  count = local.enabled ? 1 : 0
  name  = module.eks.outputs.eks_cluster_id
}

# Fetch all VPC subnet CIDRs to advertise as Tailscale routes
data "aws_subnet" "vpc_subnets" {
  for_each = local.enabled ? data.aws_eks_cluster.kubernetes[0].vpc_config[0].subnet_ids : []
  id       = each.value
}

# The final routes string merges user-supplied routes with auto-discovered VPC subnets:
# local.routes = join(",", concat(var.routes, [for k, v in data.aws_subnet.vpc_subnets : v.cidr_block]))
# e.g. "10.0.0.0/8,192.168.1.0/24,192.168.2.0/24"
```

--------------------------------

### Kubernetes Authentication: Local Kubeconfig File

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Configures the module to use a local kubeconfig file for Kubernetes authentication. Specify the file path and optionally the context to use.

```hcl
# Mode 3: local kubeconfig file
module "eks_tailscale" {
  # ...
  kubeconfig_file_enabled = true
  kubeconfig_file         = "~/.kube/config"
  kubeconfig_context      = "arn:aws:eks:us-east-2:123456789012:cluster/my-cluster"
}
```

--------------------------------

### Kubernetes Service Accounts for Operator and Proxies

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Provisions two Kubernetes Service Accounts: 'operator' for the Tailscale operator and 'proxies' for proxy pods spawned by the operator. Verify using kubectl.

```hcl
resource "kubernetes_service_account" "operator" {
  metadata {
    name      = "operator"
    namespace = var.kubernetes_namespace
  }
}

resource "kubernetes_service_account" "proxies" {
  metadata {
    name      = "proxies"
    namespace = var.kubernetes_namespace
  }
}

# Verify
# kubectl get serviceaccounts -n tailscale
# Expected output:
# NAME       SECRETS   AGE
# default    0         10m
# operator   0         5m
# proxies    0         5m
```

--------------------------------

### Output Kubernetes Deployment Object

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Exposes the full `kubernetes_deployment` resource object for downstream Terraform configurations to reference deployment attributes.

```hcl
output "deployment" {
  value       = kubernetes_deployment.operator
  description = "Tailscale operator deployment K8S resource"
}
```

--------------------------------

### Deploy Tailscale Operator in Kubernetes

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Deploys a single-replica Tailscale operator pod. The operator hostname is composed from tenant, environment, and stage labels. OAuth credentials are mounted read-only.

```hcl
resource "kubernetes_deployment" "operator" {
  metadata {
    name      = coalesce(var.deployment_name, "tailscale-operator")
    namespace = var.kubernetes_namespace
    labels    = { app = "tailscale" }
  }

  spec {
    replicas = 1
    strategy { type = "Recreate" }

    selector {
      match_labels = { app = "operator" }
    }

    template {
      metadata {
        labels = { app = "operator" }
      }

      spec {
        service_account_name = "operator"

        volume {
          name = "oauth"
          secret { secret_name = "operator-oauth" }
        }

        container {
          name  = "tailscale"
          image = format("%s:%s", var.image_repo, var.image_tag)
          # e.g. "tailscale/k8s-operator:unstable"

          env {
            name = "OPERATOR_HOSTNAME"
            value = "tailscale-operator-acme-ue2-prod"
          }
          env {
            name = "OPERATOR_SECRET"
            value = "operator"
          }
          env {
            name = "OPERATOR_LOGGING"
            value = "info"
          }
          env {
            name = "CLIENT_ID_FILE"
            value = "/oauth/client_id"
          }
          env {
            name = "CLIENT_SECRET_FILE"
            value = "/oauth/client_secret"
          }
          env {
            name = "PROXY_IMAGE"
            value = "tailscale/tailscale:unstable"
          }
          env {
            name = "PROXY_TAGS"
            value = "tag:k8s"
          }
          env {
            name = "AUTH_PROXY"
            value = "false"
          }

          resources {
            requests = { cpu = "500m", memory = "100Mi" }
          }

          volume_mount {
            name       = "oauth"
            read_only  = true
            mount_path = "/oauth"
          }
        }
      }
    }
  }
}

# Monitor deployment rollout
# kubectl rollout status deployment/tailscale-operator -n tailscale
# kubectl logs -l app=operator -n tailscale --follow
```

--------------------------------

### Namespace-Scoped Permissions (Role and RoleBinding)

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Defines namespace-scoped roles for the 'operator' (managing secrets and statefulsets) and 'proxies' (managing secrets) within the Tailscale namespace. Verify using kubectl.

```hcl
resource "kubernetes_role" "operator" {
  metadata {
    name      = "operator"
    namespace = var.kubernetes_namespace
  }

  rule {
    verbs      = ["*"]
    api_groups = [""]
    resources  = ["secrets"]
  }

  rule {
    verbs      = ["*"]
    api_groups = ["apps"]
    resources  = ["statefulsets"]
  }
}

resource "kubernetes_role" "proxies" {
  metadata {
    name      = "proxies"
    namespace = var.kubernetes_namespace
  }

  rule {
    verbs      = ["*"]
    api_groups = [""]
    resources  = ["secrets"]
  }
}

# Verify
# kubectl describe role operator -n tailscale
# kubectl describe role proxies -n tailscale
```

--------------------------------

### Pre-populate SSM Parameters for Tailscale OAuth

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Use these AWS CLI commands to store Tailscale OAuth client ID and secret in SSM. These parameters must be set before applying Terraform configurations.

```bash
aws ssm put-parameter \
  --region us-east-2 \
  --name "/tailscale/client_id" \
  --value "tskey-client-xxxxxxxxxxxx" \
  --type "SecureString"

aws ssm put-parameter \
  --region us-east-2 \
  --name "/tailscale/client_secret" \
  --value "tskey-secret-xxxxxxxxxxxx" \
  --type "SecureString"

# Verify
aws ssm get-parameters \
  --region us-east-2 \
  --names "/tailscale/client_id" "/tailscale/client_secret" \
  --with-decryption \
  --query "Parameters[*].{Name:Name,Value:Value}"
```

--------------------------------

### Kubernetes Authentication: Exec-based Token (Default)

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Configures the module to use `aws eks get-token` for Kubernetes authentication, which is the recommended default for EKS. `kube_exec_auth_role_arn_enabled` defaults to true, utilizing the IAM Roles for Service Accounts (IRSA) ARN.

```hcl
# Mode 1 (default): exec-based token via aws eks get-token
module "eks_tailscale" {
  # ...
  kube_exec_auth_enabled          = true   # default
  kube_exec_auth_role_arn_enabled = true   # default; uses iam_roles module ARN
  kube_exec_auth_role_arn         = "arn:aws:iam::123456789012:role/my-terraform-role"
  kubeconfig_exec_auth_api_version = "client.authentication.k8s.io/v1beta1"
}
```

--------------------------------

### Kubernetes Authentication: Data-source Token

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Configures the module to use the `aws_eks_cluster_auth` data source for Kubernetes authentication. Set `kube_exec_auth_enabled` to false and `kube_data_auth_enabled` to true.

```hcl
# Mode 2: data-source token (aws_eks_cluster_auth)
module "eks_tailscale" {
  # ...
  kube_exec_auth_enabled  = false
  kube_data_auth_enabled  = true
}
```

--------------------------------

### Terraform Module for Reading SSM Parameters

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

This Terraform block configures the cloudposse/ssm-parameter-store/aws module to read Tailscale OAuth credentials from SSM. Ensure the module version is compatible.

```hcl
# Equivalent Terraform block (from src/main.tf)
module "store_read" {
  source  = "cloudposse/ssm-parameter-store/aws"
  version = "0.13.0"

  parameter_read = [
    "/tailscale/client_id",
    "/tailscale/client_secret",
  ]
}
```

--------------------------------

### Required Terraform Provider Constraints

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Specifies the minimum required versions for Terraform and the AWS and Kubernetes providers. Ensure these constraints are met before applying the module.

```hcl
terraform {
  required_version = ">= 1.0.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.0, < 6.0.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = ">= 2.7.1"
    }
  }
}
```

--------------------------------

### Operator Cluster Permissions (ClusterRole and ClusterRoleBinding)

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Grants the 'operator' service account cluster-wide permissions for managing services and their status. This is required for the operator to expose services via Tailscale.

```hcl
resource "kubernetes_cluster_role" "tailscale_operator" {
  metadata {
    name = "tailscale-operator"
  }

  rule {
    verbs      = ["*"]
    api_groups = [""]
    resources  = ["services", "services/status"]
  }
}

resource "kubernetes_cluster_role_binding" "tailscale_operator" {
  metadata {
    name = "tailscale-operator"
  }

  subject {
    kind      = "ServiceAccount"
    name      = "operator"
    namespace = var.kubernetes_namespace
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = "tailscale-operator"
  }
}

# Verify RBAC
# kubectl describe clusterrolebinding tailscale-operator
```

--------------------------------

### Reference Tailscale Operator Image and Name

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Access the computed image and name for the Tailscale operator deployment. These outputs can be used in downstream modules or stacks.

```hcl
output "tailscale_operator_image" {
  value = module.eks_tailscale.deployment.spec[0].template[0].spec[0].container[0].image
  # e.g. "tailscale/k8s-operator:unstable"
}

output "tailscale_operator_name" {
  value = module.eks_tailscale.deployment.metadata[0].name
  # e.g. "tailscale-operator"
}
```

--------------------------------

### Clean Up Terraform Test Artifacts with Atmos

Source: https://github.com/cloudposse-terraform-components/aws-eks-tailscale/blob/main/README.md

Remove any artifacts generated during Terraform test runs using the Atmos command-line tool. This helps maintain a clean testing environment.

```bash
atmos test clean
```

--------------------------------

### Configure AWS Provider with Dynamic IAM Role Assumption

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Configures the AWS provider to assume the correct Terraform IAM role using `cloudposse/account-map`. Supports AWS profile-based and role ARN-based authentication.

```hcl
# src/providers.tf
provider "aws" {
  region  = var.region

  # Use AWS profile if profiles are enabled in account-map
  profile = module.iam_roles.profiles_enabled ? coalesce(var.import_profile_name, module.iam_roles.terraform_profile_name) : null

  # Otherwise assume a role ARN
  dynamic "assume_role" {
    for_each = module.iam_roles.profiles_enabled ? [] : ["role"]
    content {
      role_arn = coalesce(var.import_role_arn, module.iam_roles.terraform_role_arn)
    }
  }
}

module "iam_roles" {
  source  = "../../account-map/modules/iam-roles"
  context = module.this.context
}

# Override for manual resource import
variable "import_role_arn" {
  type    = string
  default = null
  # Usage: terraform import -var='import_role_arn=arn:aws:iam::123456789012:role/ops' ...
}
```

--------------------------------

### Kubernetes Secret for Operator OAuth Credentials

Source: https://context7.com/cloudposse-terraform-components/aws-eks-tailscale/llms.txt

Creates a Kubernetes Secret named 'operator-oauth' to store Tailscale OAuth credentials. This secret is consumed by the operator pod via a volume mount.

```hcl
resource "kubernetes_secret" "operator_oauth" {
  metadata {
    name      = "operator-oauth"
    namespace = var.kubernetes_namespace  # e.g. "tailscale"
  }
  data = {
    client_id     = module.store_read.map["/tailscale/client_id"]
    client_secret = module.store_read.map["/tailscale/client_secret"]
  }
}

# Verify the secret was created
# kubectl get secret operator-oauth -n tailscale -o jsonpath='{.data}' | base64 -d
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.