tailscale / tailscale/tailscale
Revise Auth Documentation on Tailscale on Kubernetes Doc
- Dominant language
- Go
- Stars
- 36.5k
- Forks
- 3.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 123
Description
### What is the issue?
The current documented way requires someone to generate keys every 90 days, which isn't great UI/UX:
> (Optional) You can choose to use an [auth key](https://tailscale.com/kb/1085/auth-keys) to automate your container logging in to your tailnet. Create an auth key in the [Keys](https://login.tailscale.com/admin/settings/keys) page of the admin console. We recommend using an [ephemeral key](https://tailscale.com/kb/1111/ephemeral-nodes) for this purpose, since it will automatically clean up devices after they shut down. We also recommend using a [reusable key](https://tailscale.com/kb/1085/auth-keys#types-of-auth-keys) so when containers are stopped and started they can still connect to your tailnet.
This paragraph lacks nuance. Many people, when using a k8s auth key for a pod, don't want ephemeral or that the key is reusable. The state exists in the K8s secret, which is durable. Specifically, once the `_machinekey` and `device_id` variables are generated, the `authkey` is no longer interesting. The suggestion should be "One time use/non-ephemeral" if using the k8s secret and mark the host as the key doesn't expire., otherwise the old suggestion isn't bad.
### Steps to reproduce
_No response_
### Are there any recent changes that introduced the issue?
_No response_
### OS
Other
### OS version
_No response_
### Tailscale version
_No response_
### Other software
_No response_
### Bug report
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.