tailscale / tailscale/tailscale

Revise Auth Documentation on Tailscale on Kubernetes Doc

Open
#14,057 1 comment 0 reactions 0 assignees View on GitHub
Backlog kubernetes Refined T4 Docs
Dominant language
Go
Stars
36.5k
Forks
3.2k
Avg merge
2d 3h
Merged PRs (30d)
123

Description

### What is the issue?

The current documented way requires someone to generate keys every 90 days, which isn't great UI/UX:

> (Optional) You can choose to use an [auth key](https://tailscale.com/kb/1085/auth-keys) to automate your container logging in to your tailnet. Create an auth key in the [Keys](https://login.tailscale.com/admin/settings/keys) page of the admin console. We recommend using an [ephemeral key](https://tailscale.com/kb/1111/ephemeral-nodes) for this purpose, since it will automatically clean up devices after they shut down. We also recommend using a [reusable key](https://tailscale.com/kb/1085/auth-keys#types-of-auth-keys) so when containers are stopped and started they can still connect to your tailnet.

This paragraph lacks nuance. Many people, when using a k8s auth key for a pod, don't want ephemeral or that the key is reusable. The state exists in the K8s secret, which is durable. Specifically, once the `_machinekey` and `device_id` variables are generated, the `authkey` is no longer interesting. The suggestion should be "One time use/non-ephemeral" if using the k8s secret and mark the host as the key doesn't expire., otherwise the old suggestion isn't bad.

### Steps to reproduce

_No response_

### Are there any recent changes that introduced the issue?

_No response_

### OS

Other

### OS version

_No response_

### Tailscale version

_No response_

### Other software

_No response_

### Bug report

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.