alex/infrastructure
Watch
1
0
Fork
You've already forked infrastructure
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Deploy tailnet-only Tailscale IdP #219

Merged
alex merged 1 commit from wiring-guru/tsidp-grafana into main 2026-11-11 10:14:49 -07:00 AGit
Conversation 0 Commits 1 Files changed 4 +104
wiring-guru commented 2026-11-11 09:48:55 -07:00
Contributor
Copy link

Deploy tsidp as a private tailnet OIDC issuer with persistent state and a Vault-backed registration credential. Prerequisites before merge: tag:tsidp in the tailnet policy, tsidp admin capability for the intended administrator, tailnet MagicDNS and HTTPS, and KV v2 path secret/tailscale-idp/tsidp with field authkey holding a registration credential authorized for tag:tsidp. This PR does not configure Grafana or any other client. The separate Grafana onboarding PR depends on this one. No cluster changes have been applied.

Deploy tsidp as a private tailnet OIDC issuer with persistent state and a Vault-backed registration credential. Prerequisites before merge: tag:tsidp in the tailnet policy, tsidp admin capability for the intended administrator, tailnet MagicDNS and HTTPS, and KV v2 path secret/tailscale-idp/tsidp with field authkey holding a registration credential authorized for tag:tsidp. This PR does not configure Grafana or any other client. The separate Grafana onboarding PR depends on this one. No cluster changes have been applied.
Keep the issuer private on tsnet and give Grafana a userspace Tailscale HTTP proxy for its OAuth backchannel. Store registration and client credentials in Vault-backed ExternalSecrets rather than Git. Preserve local Grafana login for recovery and map new OAuth users to Viewer.
Keep the IdP server registration separate from Grafana credentials while using a reusable client tag for future OIDC applications.
wiring-guru force-pushed wiring-guru/tsidp-grafana from ee2d9312e8 to e14491c1b6
All checks were successful
Apply Argo CD Applications / update-repo-folder (push) Successful in 1s
Details
Apply Argo CD Applications / update-repo (push) Successful in 0s
Details
Apply Argo CD Applications / apply-applications (push) Successful in 2s
Details
2026-11-11 10:12:33 -07:00 Compare
wiring-guru changed title from Add Tailscale tsidp and Grafana OIDC login to Deploy tailnet-only Tailscale IdP 2026-11-11 10:12:48 -07:00
alex merged commit e14491c1b6 into main 2026-11-11 10:14:49 -07:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
alex/infrastructure!219
No description provided.