August 2022 Summaries

The August 2022 Tailscale newsletter highlights a variety of updates and community contributions, emphasizing the expanded functionality and collaboration with partners to enhance resource access through platforms like Opal, Indent, Sym, and ConductorOne. The newsletter features discussions on using Tailscale for secure connections with tools like JupyterLab, Docker, and Azure, as well as insights from community members on innovative applications such as setting up private VPNs, port forwarding, and integrating Tailscale into Kubernetes. It also covers Tailscale's advancements, including improvements to ephemeral nodes, adoption of the Tailscale Terraform provider, and the launch of a learning library to assist users in understanding topics like SSH keys and software-defined networking. Additionally, Tailscale's presence in media is noted, with appearances on podcasts to discuss the evolution of remote systems access and zero-config VPNs.

Tailscale has taken over the management and support of the Tailscale Terraform provider, a tool originally created by the community to help automate the management of Tailscale resources such as ACLs, DNS settings, and auth keys. By moving the provider to Tailscale's namespace in the Terraform registry and signing it with a Tailscale-managed key, the company commits to maintaining and developing it further, ensuring it aligns with Tailscale's API updates. Users of the community-contributed provider can transition to the new Tailscale-managed version by updating their Terraform configuration, while community contributions remain welcome. Additionally, the Tailscale Pulumi provider continues to be maintained by Pulumi, offering similar functionality by being generated from the Terraform provider. The change aims to enhance the reliability and functionality of the provider while maintaining community involvement and support.

Ephemeral nodes in Tailscale are designed for automated, short-lived workloads such as containers or CI/CD jobs, as they automatically remove themselves from the network once inactive. Previously, these nodes could clutter the network if their removal was delayed due to the coordination server's wait for potential reconnection. The introduction of the `tailscale logout` command now allows for immediate removal of these nodes, enhancing network cleanliness by quickly deleting nodes that will not return online. With Tailscale v1.30, nodes created through the CLI, which do not store state files, are instantly removed from the network upon shutdown. This improvement facilitates the reuse of MagicDNS names tied to defunct nodes and streamlines automation by allowing ephemeral nodes to be removed promptly through scripted deployments.

Tailscale and Opal have partnered to streamline on-demand access to resources in environments with strict compliance requirements by implementing the principle of least privilege. Tailscale ACLs enable organizations to define and restrict access, but the partnership with Opal allows for temporary, self-serve access requests, facilitating faster resource availability without manual intervention. Opal allows administrators to manage SSH access rules, automate approval processes, and define access durations, enhancing security and efficiency. The integration also supports user and group provisioning through Okta, enabling seamless onboarding and automated access management, which can be tailored to organizational needs, such as on-call schedules.

Tailscale has partnered with Sym to enhance secure, on-demand access to sensitive resources via Slack, addressing situations like emergencies where immediate access is necessary. Tailscale's Access Control Lists (ACLs) allow users to manage resource access, but Sym introduces intelligent approvals as code, enabling temporary, time-limited access for engineers needing to address specific tasks. By integrating Sym with Tailscale, users can request and approve access directly through Slack, and access is automatically revoked after the specified duration. This integration also supports SSH access by updating group memberships within Tailscale's ACLs and can be further streamlined with Sym's Python SDK for specific routing rules or automated approvals based on identity or on-call status. Additionally, for organizations using Okta, Sym facilitates managing group memberships synced from Okta to Tailscale, ensuring that the right team members receive access to necessary resources efficiently.

Tailscale, in collaboration with ConductorOne, offers a solution for automating access requests and approvals to sensitive resources within a Tailscale network, such as production nodes and databases, through the implementation of modern governance and access control policies. This integration allows for the centralization of Tailscale identities and ACLs into an automated identity security control center, enabling on-demand and time-bound access to resources, including those managed via Tailscale SSH. ConductorOne simplifies this process by allowing users to request access through platforms like Slack or the web, which triggers automated approval workflows based on predefined policies and access rules. The system ensures that unnecessary persistent access is avoided, granting users access only to the resources they need for a specific period. Additionally, it provides the ability to automate access reviews, audit reports, and manage requests effectively, with the synchronization of changes between ConductorOne and Tailscale, including integration with Okta for user provisioning.