When I was trying to install tailscale operator, it has the following error:
failed to verify certificate: x509: certificate is valid for *.kube.cloud.dev, not kubernetes.default.svc

Do you see this in operator's logs? Or, in one of proxy's logs?

The operator itself uses controller-runtime client with a client-go mechanism for retrieving api-server address etc. It does not use the client that you linked. However, the proxies that we create do.

If possible, we should try to auto-detect the address.

@irbekrm Thank you for the response! Yeah, I think there's only one container in the pod operator-58b8c85c97-5ztvb and the container's name is operator. So I think it should be the operator's logs.

I went through the Dockerfile for tailscale repo and found that it only builds the image for tailscale, but not the operator. Do you know where's the script/Dockerfile to build the operator? @irbekrm

Since I couldn't build and testing locally, here's one suggestion of change for detecting and updating the kube server address: (looks like I couldn't create the PR)
In the file: tailscale/cmd/k8s-operator/operator.go:

1. Add this dependency: "k8s.io/client-go/tools/clientcmd"
2. Add this function:

func loadConfigWithApiServer() (*rest.Config, error) {
	fmt.Printf("Entring loadConfigWithApiServer\n")
	loadingRules := clientcmd.NewDefaultClientConfigLoadingRules()
	if _, ok := os.LookupEnv("HOME"); !ok {
		u, err := user.Current()
		if err != nil {
			return nil, fmt.Errorf("could not get current user: %w", err)
		}
		loadingRules.Precedence = append(loadingRules.Precedence, filepath.Join(u.HomeDir, clientcmd.RecommendedHomeDir, clientcmd.RecommendedFileName))
	}	
	
	return config.loadConfigWithContext(fmt.Sprintf("https://%s:%s", os.Getenv("KUBERNETES_SERVICE_HOST"), os.Getenv("KUBERNETES_SERVICE_PORT_HTTPS")), loadingRules, "")
}

3. Change this line in the main():
   restConfig := config.GetConfigOrDie()
   to this line:
   restConfig := loadConfigWithApiServer()

I refer to this function in config.go: link. In this way, we can dynamically update the kube service address easily. Please help to review if this one is feasible. Thank you! @irbekrm