Automation
Tailscale GitOps: review policy changes before production.
GitOps makes tailnet policy version-controlled and testable and supports controlled rollback to a previously validated policy version. It does not automatically reverse side effects in applications, networks or identity systems.
Change workflow
Rationale → diff → tests → approval → deployment.
A Git repository alone does not constitute a control. The right model combines an owner, reviewer, automated validation, restricted deployment permission and a validated rollback version.
- 1
Open a change
Record the use case, owner, validity period and impact.
- 2
Validate the complete policy
Check syntax, positive and negative access tests and SSH tests; additive rules make single-rule review insufficient.
- 3
Review and deploy
A restricted machine identity deploys the approved version to the tailnet.
- 4
Evidence and rollback
Retain test results, the change trail and a previously validated policy version; document any external recovery steps separately.
Machine permissions
OAuth, API tokens, auth keys and workload identity are not interchangeable.
An OAuth client receives restricted scopes and, when needed, tags. A personal API token expires and remains tied to a user. Auth keys enrol nodes. With Workload Identity Federation, a matching provider-signed OIDC token is exchanged for a scoped, short-lived Tailscale API token; it is not a credential for the destination application.
OAuth and federation
- restricted scopes, tags and OIDC claim rules
- service identity for automation
- avoid a long-lived secret where federation is supported
API and auth keys
- only required operations
- short validity and secure storage
- ephemeral, pre-approved and reusable choices are explicit
Webhooks
- validate the request and expected event source
- device and approval events
- idempotency, workflow and error handling
Tailscale Services
- stable
svc:identity decoupled from individual tagged hosts - host approval, availability and application authentication remain explicit
- service endpoints are TCP-first; Linux layer-3 mode requires separate OS configuration
AIM model
Automation receives only the permissions required for its task.
Advice defines the change process, repository ownership and machine permissions. Integrate implements pipeline validation, OAuth/API or federated integrations and webhooks. Manage maintains the lifecycle of secrets, claims, scopes, tests and deployment permissions.
