tailscale-login should support gcp instance metadata endpoint

Created on 2 Mar 2020 · 5Comments · Source: tailscale/tailscale

Is your feature request related to a problem? Please describe.

The best way in my opinion to make a node login is thru instance metadata. I don't necessarily want to tie a machine login with a useraccount (off-boarding problems and such).

Describe the solution you'd like

I can associate a GCP VM with a specific service account with (even with no permissions) at i should be be able to run tailscale-login without redirection to browser

┆Issue is synchronized with this Asana task by Unito

L3 Some users P3 Can't get started T6 Major usability cloud enhancement

Source

gitirabassi

👍1

Most helpful comment

Thanks for filing. Our short term focus is on the various connectivity issues, but these sorts of automated device enrollments & cloud integrations are definitely on our roadmap a bit down the line.

bradfitz on 3 Mar 2020

👍3

All 5 comments

Thanks for filing. Our short term focus is on the various connectivity issues, but these sorts of automated device enrollments & cloud integrations are definitely on our roadmap a bit down the line.

bradfitz on 3 Mar 2020

👍3

if this is something that can be solved on the opensource side of things, can you point me to it?

gitirabassi on 6 Mar 2020

The way I read your bug report was "Make Cloud VM/containers/service-accounts/auto-provisioning work, somehow".

I'm not exactly sure what the final design will be, or what design you have in your head.

We need to figure that out before deciding where exactly in the code it'll go.

We have some rough sketch of a design where you can create a provisioning token in the admin panel (or using the admin API) and then use it to enroll other machine keys. But that would be server-side, and we haven't yet untangled that enough to open source it.

You want to lay out a more concrete, detailed proposal?

bradfitz on 6 Mar 2020

The way I read your bug report was "Make Cloud VM/containers/service-accounts/auto-provisioning work, somehow".

What if we could use a TLS certificate to enable automatic provisioning?
The node presents the tailscale control plane with a certificate issued by a trusted CA, which is used to associate the node with a domain (using the common name?). All that remains is for an admin to approve the new node on the tailscale admin console.