feat: support workload identity federation and reading auth key/ID token from files#239
Open
SamyDjemai wants to merge 1 commit into
Open
feat: support workload identity federation and reading auth key/ID token from files#239SamyDjemai wants to merge 1 commit into
SamyDjemai wants to merge 1 commit into
Conversation
…ken from files Adds two file-based credential options, useful for running golink on infrastructure that provides secrets as mounted files: - --auth-key-file (TS_AUTHKEY_FILE): read the Tailscale auth key from a file instead of passing it inline (tailscale#237). - --id-token-file (TS_ID_TOKEN_FILE): read an OIDC ID token from a file for workload identity federation, e.g. a mounted Kubernetes ServiceAccount token (tailscale#238). Also blank-imports tailscale.com/feature/identityfederation so tsnet's WIF authentication path (TS_CLIENT_ID + TS_ID_TOKEN/TS_AUDIENCE) is linked in; it is not linked by default upstream. Signed-off-by: Samy Djemaï <53857555+SamyDjemai@users.noreply.github.com>
SamyDjemai
force-pushed
the
wif-and-authkey-file
branch
from
b35e3b0 to
8b139f1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds two file-based credential options to golink, plus links in tsnet's workload identity federation (WIF) support.
--auth-key-file/TS_AUTHKEY_FILE(fixes #237)Read the Tailscale auth key from a file instead of passing it inline. Useful when the key is provided as a mounted secret.
--id-token-file/TS_ID_TOKEN_FILE+ WIF (fixes #238)Authenticate via workload identity federation instead of an auth key. The ID token can be read from a file, which is the natural fit for a Kubernetes pod's mounted ServiceAccount token (it's a file, not an env var, and rotates over time).
Per the tsnet docs, WIF support is not linked by default (to keep cloud-provider SDK deps out of programs that don't use it), so this PR adds a blank import of
tailscale.com/feature/identityfederation.TS_CLIENT_ID,TS_ID_TOKEN, andTS_AUDIENCEcontinue to be honored directly by tsnet; this PR only adds the file-based ID token option and the feature link.Implementation notes
readFlagFilehelper (returns""for an empty path, trims trailing whitespace). This matches tsnet's behavior: the credentials are only used during initial node enrollment and ignored once state is persisted, so a single read is sufficient.AuthKeyandIDTokenare set on thetsnet.Server; existingTS_AUTHKEYbehavior is unchanged when the new flags are not used.Testing
go build ./...,go vet ./...cleango test ./...— all existing tests pass