davidsbond/vault-plugin-tailscale

A HashiCorp Vault plugin for managing Tailscale authentication keys

vault-plugin-tailscale

A HashiCorp Vault plugin for generating device authentication keys for Tailscale. Generated keys are single use.

Installation

1. Download the binary for your architecture from the releases page
2. Generate the SHA256 sum of the plugin binary

$ sha256sum vault-plugin-tailscale | cut -d ' ' -f1
d6ffe79b13326eb472af0b670c694f21f779d524068ad705a672a00f6d433724

3. Add the plugin to your Vault plugin catalog

$ vault plugin register -sha256=d6ffe79b13326eb472af0b670c694f21f779d524068ad705a672a00f6d433724 secret vault-plugin-tailscale
Success! Registered plugin: vault-plugin-tailscale

4. Enable the plugin

$ vault secrets enable -path=tailscale vault-plugin-tailscale 
Success! Enabled the vault-plugin-tailscale secrets engine at: tailscale/

Usage

1. Obtain an API key from the Tailscale admin dashboard.
2. Create the Vault configuration for the Tailscale API

$ vault write tailscale/config tailnet=$TAILNET api_key=$API_KEY
Success! Data written to: tailscale/config

3. Generate keys using the Vault CLI.

$ vault read tailscale/key
Key          Value
---          -----
ephemeral    false
expires      2022-04-30T00:32:36Z
id           kMxzN47CNTRL
key          secret-key-data
reusable     false
tags         <nil>

Key Options

The following key/value pairs can be added to the end of the vault read command to configure key properties:

Tags

Tags to apply to the device that uses the authentication key

vault read tailscale/key tags=something:somewhere

Preauthorized

If true, machines added to the tailnet with this key will not required authorization

vault read tailscale/key preauthorized=true

Ephemeral

If true, nodes created with this key will be removed after a period of inactivity or when they disconnect from the Tailnet

vault read tailscale/key ephemeral=true

vault-plugin-tailscale's Issues

Are you using this plugin?

Recently I've noticed this repo getting a lot of stars over the last week. I say a lot, by my standards it's a lot.

Just curious if you're using this plugin at home/work successfully, let me know!

Generated Key Options - Documentation

I'd like the ability to create ephemeral keys using this plugin.

I'm not a Go programmer, but looking at the source it seems like there's the ability to customize tags and preauthorized.

Are ephemeral keys not a current capability right now, and how would I go about using the current customizations for keys?

Unrecognized Plugin Message

Hi there, I just configured the plugin for the first time. I'm getting a 500 when I try to use it, though:

$ vault secrets enable -path=tailscale tailscale
Success! Enabled the tailscale secrets engine at: tailscale/
$ vault read tailscale/config
Error reading tailscale/config: Error making API request.

URL: GET https://vault/v1/tailscale/config
Code: 500. Errors:

* 1 error occurred:
	* Unrecognized remote plugin message:

This usually means that the plugin is either invalid or simply
needs to be recompiled to support the latest protocol.

I don't see anything else in the logs. My environment is a bit weird (running inside a container, in google cloud run) but it's hard to tell if that's the cause.

Version 0.2.3 doesn't work with current tailscale

Because expirySeconds was moved in this commit, the current released version doesn't work. I've set it up and I'm currently getting the following error:

Error reading tailscale/key: Error making API request.

URL: GET https://servie.home.iruud.cloud:8200/v1/tailscale/key
Code: 500. Errors:

* 1 error occurred:
	* json: unknown field "expirySeconds" (400)

This update has already been merged on the master branch, so if a new version could be released that should fix it. I will move to use the master branch for now.

Is this compatible with HCP Vault?

Is this compatible with Hashicorp Cloud Platform https://portal.cloud.hashicorp.com/

How do I install the plugin?