k3s-io/k3s · error

Requested VPN: <name> is not supported. We currently only su

Error message

Requested VPN: <name> is not supported. We currently only support tailscale

What it means

The VPN integration implements exactly one provider: name=tailscale (case-sensitive). After the tailscale branch returns, any other authInfo.Name falls through to this error echoing the requested name. An empty name — a --vpn-auth string without name= — also lands here, producing 'Requested VPN: is not supported'.

Source

Thrown at pkg/vpn/vpn.go:156

	}
	return authInfo, nil
}

// isVPNConfigOK checks that the config is complete
func isVPNConfigOK(authInfo vpnCliAuthInfo) error {
	if authInfo.Name == "tailscale" {
		if authInfo.JoinKey == "" {
			return errors.New("VPN Error. Tailscale requires a JoinKey")
		}
		if authInfo.ControlServerURL != "" {
			if _, err := url.Parse(authInfo.ControlServerURL); err != nil {
				return fmt.Errorf("VPN Error. Invalid control server URL for Tailscale: %w", err)
			}
		}
		return nil
	}

	return errors.New("Requested VPN: " + authInfo.Name + " is not supported. We currently only support tailscale")
}

// getTailscaleInfo returns the IPs of the interface
func getTailscaleInfo() (*Info, error) {
	output, err := util.ExecCommand("tailscale", []string{"status", "--json"})
	if err != nil {
		return nil, fmt.Errorf("failed to run tailscale status --json: %v", err)
	}

	logrus.Debugf("Output from tailscale status --json: %v", output)

	var tailscaleOutput TailscaleOutput
	err = json.Unmarshal([]byte(output), &tailscaleOutput)
	if err != nil {
		return nil, fmt.Errorf("failed to unmarshal tailscale output: %v", err)
	}

	// Errors are ignored because the interface might not have ipv4 or ipv6 addresses (that's the only possible error)

View on GitHub (pinned to 6ba341e396)

Solutions

1. Use --vpn-auth="name=tailscale,..." exactly, all lowercase
2. Remove --vpn-auth (and the tailscale flannel backend) if VPN integration is not wanted
3. Check for typos: unknown parameter keys are rejected separately with 'unknown parameter'

Example fix

# before
--vpn-auth="name=zero-tier"

# after
--vpn-auth="name=tailscale,joinKey=tskey-auth-abcdef123456"

const onlySupported = "tailscale"
if name != onlySupported {
    return fmt.Errorf("unsupported VPN %q (only %s)", name, onlySupported)
}

When it happens

Trigger: --vpn-auth="name=zerotier" (or any non-tailscale value), a missing name key, or a case mismatch such as name=Tailscale.

Common situations: Attempting ZeroTier, WireGuard or other VPNs that look similar; copy/pasting flags from another tool's docs; typos in the parameter name or value.

Related errors

• Initial server URL host is not defined for load balancer
• --server is required
• etcd-snapshot-reconcile-interval must be greater than 0s
• VPN Error. Tailscale requires a JoinKey
• invalid node-external-ip: %w

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/a4f62cda538e5e9e. Report an issue: GitHub.