What are you trying to do?

Run ts in a kube environment, without the use of TS_KUBE_SECRET

How should we solve this?

In the case that someone runs tailscale in a pod with other container(s), you can't give access to the secret to a single container on that pod, service account binds to the whole pod.

Please allow having empty TS_KUBE_SECRET, so people can set a TS_STATE_DIR of their liking and also pass TS_AUTH_KEY as they please too.

Thanks.

What is the impact of not solving this?

When using it in a pod with other containers, you are force to bind a Service account to tall the containers inside that pod.

Anything else?

No response