tailscale-devices + policy: mint sidecar auth keys with per-service + host tags #144
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem
Sub-task of coilysiren/infrastructure#134. The k8s sidecar half of the per-deployment tagging story. Currently every
tailscale_tailnet_keyminted byterraform/tailscale-devices/carries onlytag:k8s, so the tailnet view can't distinguish "which k8s service is this device" or "which physical host runs it".Change
terraform/tailscale-devices/main.tf- eachtailscale_tailnet_key.servicemints with["tag:k8s", "tag:${each.key}", "tag:host-kai-server"]instead of baretag:k8s.terraform/tailscale-policy/main.tf- reads the sibling module'sservices.yamlvia cross-moduleyamldecode("../tailscale-devices/services.yaml")and registers atag:<service>tagOwner for each. Single source of truth for the service list stays intailscale-devices/services.yaml.Rollout behavior
Changing
tagsontailscale_tailnet_keytriggers a replace. The new key lands in SSM (/coilysiren/<service>/ts-authkey), but existing sidecar pods don't re-auth - theirts-stateSecret carries the original device identity from first boot, and that device keepstag:k8sonly. Gradual rollout: future deployments that wipets-state(or new services) get the rich tag set; existing devices keep tag:k8s until a manual re-auth or state-Secret bounce.If you want every existing sidecar to carry the rich tags now, that's a per-namespace
kubectl delete secret ts-state-<service>+kubectl rollout restart deployment/<service>sweep, tracked in a follow-up issue rather than baked into this commit.Tag model after this lands:
tag:k8s- "this is a sidecar device" (all k8s pods)tag:host-kai-server- "the underlying physical host is kai-server"tag:<service>- per-service identity (eco-mcp, repo-recall, forgejo, etc.)Filed by Claude.