starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #2931] [MERGED] tags: process tags on registration, simplify policy #2943

New Issue
Closed
opened 2025-12-29 04:19:45 +01:00 by adam · 0 comments
adam commented 2025-12-29 04:19:45 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/2931
Author: @kradalby
Created: 12/3/2025
Status: ✅ Merged
Merged: 12/8/2025
Merged by: @kradalby

Base: main ← Head: kradalby/tags-resolve

📝 Commits (10+)

  • 4d264c0 policy: simplify tag and autogroup resolution for tags-as-identity
  • 3ffb2c7 policy: update tests for tags-as-identity model
  • 30a5d66 state: process advertise-tags during registration
  • d95f3c4 integration: add CreateAuthKeyWithTags helper
  • eeeb36b integration: add tests for advertise-tags behavior
  • 9cacfa4 changelog: document tags-as-identity changes
  • 8c2e5f5 integration: initial full tag matrix test
  • f29988a .github/workflows: regen
  • 6651911 auth: fixup tests
  • 7326d61 integration: cleanup duplicate tests

📊 Changes

24 files changed (+3401 additions, -988 deletions)

View changed files

📝 .github/workflows/test-integration.yaml (+27 -4)
📝 .golangci.yaml (+10 -0)
📝 AGENTS.md (+40 -1)
📝 CHANGELOG.md (+8 -0)
📝 go.sum (+0 -6)
📝 hscontrol/auth_test.go (+130 -5)
📝 hscontrol/grpcv1.go (+1 -8)
📝 hscontrol/grpcv1_test.go (+2 -2)
📝 hscontrol/mapper/builder.go (+2 -2)
📝 hscontrol/mapper/tail.go (+1 -22)
📝 hscontrol/mapper/tail_test.go (+0 -10)
📝 hscontrol/policy/pm.go (+3 -0)
📝 hscontrol/policy/v2/policy.go (+214 -1)
📝 hscontrol/policy/v2/types.go (+3 -186)
📝 hscontrol/policy/v2/types_test.go (+255 -52)
📝 hscontrol/state/state.go (+55 -4)
📝 hscontrol/state/tags.go (+3 -42)
📝 integration/acl_test.go (+16 -17)
📝 integration/cli_test.go (+0 -596)
📝 integration/control.go (+2 -0)

...and 4 more files

📄 Description

This PR investigates, adds tests and aims to correctly implement Tailscale's model for how Tags should be accepted, assigned and used to identify nodes in the Tailscale access and ownership model.

When evaluating in Headscale's policy, Tags are now only checked against a nodes "tags" list, which defines the source of truth for all tags for a given node. This simplifies the code for dealing with tags greatly, and should help us have less access bugs related to nodes belonging to tags or users.

A node can either be owned by a user, or a tag.

Next, to ensure the tags list on the node is correctly implemented, we first add tests for every registration scenario and combination of user, pre auth key and pre auth key with tags with the same registration expectation as observed by trying them all with the Tailscale control server. This should ensure that we implement the correct behaviour and that it does not change or break over time.

Lastly, the missing parts of the auth has been added, or changed in the cases where it was wrong. This has in large parts allowed us to delete and simplify a lot of code.
Now, tags can only be changed when a node authenticates or if set via the CLI/API. Tags can only be fully overwritten/replaced and any use of either auth or CLI will replace the current set if different.

A user owned device can be converted to a tagged device, but it cannot be changed back. A tagged device can never remove the last tag either, it has to have a minimum of one.

Checking all imaginable Tailscale SaaS auth combinations:
image

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/2931 **Author:** [@kradalby](https://github.com/kradalby) **Created:** 12/3/2025 **Status:** ✅ Merged **Merged:** 12/8/2025 **Merged by:** [@kradalby](https://github.com/kradalby) **Base:** `main` ← **Head:** `kradalby/tags-resolve` --- ### 📝 Commits (10+) - [`4d264c0`](https://github.com/juanfont/headscale/commit/4d264c082cece2daf5600bc6c149bc7162b202b1) policy: simplify tag and autogroup resolution for tags-as-identity - [`3ffb2c7`](https://github.com/juanfont/headscale/commit/3ffb2c79eb17ba955a9fdb6fe084028843d4f950) policy: update tests for tags-as-identity model - [`30a5d66`](https://github.com/juanfont/headscale/commit/30a5d66be28055209fff0ceece8ba5fb0642ebdc) state: process advertise-tags during registration - [`d95f3c4`](https://github.com/juanfont/headscale/commit/d95f3c463a26df73c35ea5a7abe93c54ab63df23) integration: add CreateAuthKeyWithTags helper - [`eeeb36b`](https://github.com/juanfont/headscale/commit/eeeb36b43ae978e3a5f6df826c4de131592466de) integration: add tests for advertise-tags behavior - [`9cacfa4`](https://github.com/juanfont/headscale/commit/9cacfa4b764c85a2d0acf5ae405e6c45a7497056) changelog: document tags-as-identity changes - [`8c2e5f5`](https://github.com/juanfont/headscale/commit/8c2e5f5025ae33f0c0d424bedb632616d652d4c3) integration: initial full tag matrix test - [`f29988a`](https://github.com/juanfont/headscale/commit/f29988afaac2af440ad66dafa13c565640862d47) .github/workflows: regen - [`6651911`](https://github.com/juanfont/headscale/commit/6651911f57b2e6a4ac5e27d289bbd8b96c21beed) auth: fixup tests - [`7326d61`](https://github.com/juanfont/headscale/commit/7326d61fdd8d4d71182bd8654deaf6d22443cdcc) integration: cleanup duplicate tests ### 📊 Changes **24 files changed** (+3401 additions, -988 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/test-integration.yaml` (+27 -4) 📝 `.golangci.yaml` (+10 -0) 📝 `AGENTS.md` (+40 -1) 📝 `CHANGELOG.md` (+8 -0) 📝 `go.sum` (+0 -6) 📝 `hscontrol/auth_test.go` (+130 -5) 📝 `hscontrol/grpcv1.go` (+1 -8) 📝 `hscontrol/grpcv1_test.go` (+2 -2) 📝 `hscontrol/mapper/builder.go` (+2 -2) 📝 `hscontrol/mapper/tail.go` (+1 -22) 📝 `hscontrol/mapper/tail_test.go` (+0 -10) 📝 `hscontrol/policy/pm.go` (+3 -0) 📝 `hscontrol/policy/v2/policy.go` (+214 -1) 📝 `hscontrol/policy/v2/types.go` (+3 -186) 📝 `hscontrol/policy/v2/types_test.go` (+255 -52) 📝 `hscontrol/state/state.go` (+55 -4) 📝 `hscontrol/state/tags.go` (+3 -42) 📝 `integration/acl_test.go` (+16 -17) 📝 `integration/cli_test.go` (+0 -596) 📝 `integration/control.go` (+2 -0) _...and 4 more files_ </details> ### 📄 Description This PR investigates, adds tests and aims to correctly implement Tailscale's model for how Tags should be accepted, assigned and used to identify nodes in the Tailscale access and ownership model. When evaluating in Headscale's policy, Tags are now only checked against a nodes "tags" list, which defines the source of truth for all tags for a given node. This simplifies the code for dealing with tags greatly, and should help us have less access bugs related to nodes belonging to tags or users. **A node can _either_ be owned by a user, or a tag**. Next, to ensure the tags list on the node is correctly implemented, we first add tests for every registration scenario and combination of user, pre auth key and pre auth key with tags with the same registration expectation as observed by trying them all with the Tailscale control server. This should ensure that we implement the correct behaviour and that it does not change or break over time. Lastly, the missing parts of the auth has been added, or changed in the cases where it was wrong. This has in large parts allowed us to delete and simplify a lot of code. Now, tags can _only_ be changed when a node authenticates or if set via the CLI/API. Tags can only be fully overwritten/replaced and any use of either auth or CLI will replace the current set if different. A user owned device can be converted to a tagged device, but it cannot be changed back. A tagged device can never remove the last tag either, it has to have a minimum of one. Checking all imaginable Tailscale SaaS auth combinations: <img width="1003" height="691" alt="image" src="https://github.com/user-attachments/assets/052c0de3-5191-4756-a0fe-eee644b46b2d" /> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 04:19:45 +01:00
adam closed this issue 2025-12-29 04:19:45 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#2943
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?