Skip to content

Commit 1284197

Browse files
rajsinghtechrajsinghtech
committed
Refactor tailscale policy configuration by removing commented sections and updating network definitions. Adjusted IP ranges for St Petersburg and streamlined access grants for improved clarity and functionality.
1 parent 5f4d068 commit 1284197

File tree

1 file changed

+30
-194
lines changed

1 file changed

+30
-194
lines changed

‎tailscale/policy.hujson‎

Lines changed: 30 additions & 194 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,6 @@
11
// This tailnet's ACLs are maintained in https://github.com/rajsinghtech/kubernetes-manifests
22
{
3-
// ============================================================================
4-
// NETWORK CONFIGURATION
5-
// ============================================================================
6-
73
"randomizeClientPort": false,
8-
9-
// ============================================================================
10-
// NETWORK DEFINITIONS
11-
// ============================================================================
12-
13-
// IP sets for subnet routing and network segmentation
144
"ipsets": {
155
// Robbinsdale site networks
166
"ipset:robbinsdale": [
@@ -20,7 +10,6 @@
2010
"10.0.0.0/16", // Service network range
2111
"10.1.0.0/16", // Pod network range
2212
],
23-
2413
// Ottawa site networks
2514
"ipset:ottawa": [
2615
"192.168.169.0/24", // Main LAN
@@ -29,30 +18,15 @@
2918
"10.2.0.0/16", // Service network range
3019
"10.3.0.0/16", // Pod network range
3120
],
32-
3321
// St Petersburg site networks
3422
"ipset:stpetersburg": [
3523
"192.168.73.0/24", // Main LAN
36-
"10.69.3.0/24", // LB network range
24+
"10.73.3.0/24", // LB network range
3725
"10.4.0.0/16", // Service network range
3826
"10.5.0.0/16", // Pod network range
3927
"fd7a:115c:a1e0:b1a:0:3::/96", // 4via6 subnet
4028
],
41-
42-
// US West 2 site networks
43-
"ipset:usw2": [
44-
"10.226.0.0/16", // Main VPC CIDR
45-
"10.80.0.0/16", // Pod network range
46-
"10.81.0.0/16", // Service network range
47-
"fd7a:115c:a1e0:b1a:0:4::/96" // 4via6 subnet
48-
],
4929
},
50-
51-
// ============================================================================
52-
// GROUPS
53-
// ============================================================================
54-
55-
// Define user groups for access control
5630
"groups": {
5731
"group:superuser": [
5832
"kbpersonal@github",
@@ -61,134 +35,61 @@
6135
"[email protected]"
6236
]
6337
},
64-
65-
// ============================================================================
66-
// TAG OWNERSHIP & MANAGEMENT
67-
// ============================================================================
68-
69-
// Define who can assign and manage each tag
7038
"tagOwners": {
7139
// Core infrastructure tags
7240
"tag:k8s-operator": [],
7341
"tag:k8s": ["tag:k8s-operator", "autogroup:admin"],
74-
"tag:k8s-recorder": ["tag:k8s-operator", "autogroup:admin"],
75-
"tag:infra": ["autogroup:admin", "tag:infra"],
76-
"tag:udm": ["autogroup:admin", "tag:infra"],
77-
42+
"tag:k8s-recorder": ["tag:k8s-operator"],
43+
"tag:udm": ["autogroup:admin"],
7844
// Site-specific tags
79-
"tag:keiretsu": ["tag:k8s-operator", "autogroup:admin", "tag:infra"],
80-
"tag:robbinsdale": ["tag:k8s-operator", "autogroup:admin", "tag:infra"],
81-
"tag:ottawa": ["tag:k8s-operator", "autogroup:admin", "tag:infra"],
82-
"tag:stpetersburg": ["tag:k8s-operator", "autogroup:admin", "tag:infra"],
83-
"tag:pittsburgh": ["tag:k8s-operator", "autogroup:admin", "tag:infra"],
84-
"tag:use1": ["tag:k8s-operator", "autogroup:admin", "tag:infra"],
85-
"tag:usw2": ["tag:k8s-operator", "autogroup:admin", "tag:infra"],
86-
"tag:kind": ["tag:k8s-operator", "autogroup:admin", "tag:infra"],
87-
88-
// Site-specific infrastructure tags
89-
"tag:ottawa-infra": ["autogroup:admin", "tag:infra"],
90-
91-
// TCP-443-only tag
92-
"tag:restricted-outbound": ["tag:k8s-operator", "autogroup:admin"],
45+
"tag:robbinsdale": ["tag:k8s-operator", "autogroup:admin"],
46+
"tag:ottawa": ["tag:k8s-operator", "autogroup:admin"],
47+
"tag:stpetersburg": ["tag:k8s-operator", "autogroup:admin"],
9348
},
94-
95-
// ============================================================================
96-
// AUTO-APPROVAL RULES
97-
// ============================================================================
98-
9949
// Automatically approve certain requests without manual intervention
10050
"autoApprovers": {
10151
"exitNode": ["tag:k8s"],
10252
"routes": {
10353
"0.0.0.0/0": ["tag:k8s"], // Default route (exit node)
10454
"::/0": ["tag:k8s"], // IPv6 default route
10555
"192.168.50.0/24": ["tag:robbinsdale"], // Robbinsdale LAN
106-
"192.168.169.0/24": ["tag:ottawa", "tag:ottawa-infra"], // Ottawa LAN
56+
"192.168.169.0/24": ["tag:ottawa"], // Ottawa LAN
10757
"192.168.73.0/24": ["tag:stpetersburg"], // St Petersburg LAN
108-
"10.80.0.0/16": ["tag:ottawa-infra"], // US West 2 EKS Hybrid cluster control plane/Ottawa worker node pod cidr
109-
"10.81.0.0/16": ["tag:ottawa-infra"], // US West 2 EKS Hybrid cluster control plane/Ottawa worker node pod cidr
110-
"10.226.0.0/16": ["tag:usw2"], // US West 2 VPC cidr
11158
},
11259
"services": {
113-
"tag:keiretsu": ["tag:k8s"],
11460
"tag:k8s": ["tag:k8s"],
11561
},
11662
},
117-
118-
// ============================================================================
119-
// SSH ACCESS CONFIGURATION
120-
// ============================================================================
121-
12263
// Define SSH access policies
12364
"ssh": [
12465
{
12566
"action": "accept",
12667
"src": ["group:superuser"],
127-
"dst": ["tag:ottawa", "tag:ottawa-infra", "tag:robbinsdale"],
68+
"dst": ["tag:ottawa", "tag:robbinsdale", "tag:stpetersburg"],
12869
"users": ["root", "autogroup:nonroot"],
12970
"recorder": ["tag:k8s-recorder"],
13071
"enforceRecorder": true,
13172
},
13273
],
133-
134-
// ============================================================================
135-
// ACCESS GRANTS (NETWORK & APPLICATION POLICIES)
136-
// ============================================================================
137-
13874
"grants": [
139-
// ------------------------------------------------------------------------
140-
// BASIC NETWORK ACCESS
141-
// ------------------------------------------------------------------------
142-
143-
// Allow Superuser to access all robbinsdale nodes
144-
{
145-
"src": ["group:superuser", "ipset:robbinsdale", "tag:robbinsdale"],
146-
"dst": ["tag:robbinsdale"],
147-
"ip": ["*"],
148-
"app": {
149-
"rajsingh.info/cap/tsdnsproxy": [
150-
{
151-
"robbinsdale.k8s": {
152-
"dns": ["10.0.0.10:53"],
153-
"rewrite": "svc.cluster.local",
154-
"translateid": 1
155-
}
156-
}
157-
]
158-
}
159-
},
160-
161-
// Allow Superuser to access all ottawa nodes
162-
{
163-
"src": ["group:superuser", "tag:ottawa"],
164-
"dst": ["tag:ottawa"],
165-
"ip": ["*"],
166-
"app": {
167-
"rajsingh.info/cap/tsdnsproxy": [
168-
{
169-
"ottawa.k8s": {
170-
"dns": ["10.2.0.10:53"],
171-
"rewrite": "svc.cluster.local",
172-
"translateid": 2
173-
}
174-
}
175-
]
176-
}
177-
},
178-
// Kubernetes operator internal networking
75+
// Allow members to access their own devices
17976
{
180-
"src": ["tag:k8s-operator"],
181-
"dst": ["tag:k8s"],
77+
"src": ["autogroup:member"],
78+
"dst": ["autogroup:self"],
18279
"ip": ["*"],
18380
},
184-
81+
// Allow Superuser to access all location nodes
82+
{
83+
"src": ["group:superuser", "tag:ottawa", "tag:robbinsdale", "tag:stpetersburg"],
84+
"dst": ["tag:ottawa", "tag:robbinsdale", "tag:stpetersburg"],
85+
"ip": ["*"],
86+
},
18587
// Allow members to reach k8s nodes and directly
18688
{
187-
"src": ["group:superuser", "tag:k8s", "tag:k8s-operator"],
188-
"dst": ["tag:k8s",],
89+
"src": ["tag:k8s"],
90+
"dst": ["tag:k8s"],
18991
"ip": ["*"],
19092
},
191-
19293
// Allow members to reach udm nodes
19394
{
19495
"src": ["group:superuser", "tag:udm", "tag:k8s", "tag:k8s-operator"],
@@ -198,67 +99,36 @@
19899
"tailscale.com/cap/relay": [],
199100
},
200101
},
201-
202-
// Allow members to access their own devices
203-
{
204-
"src": ["autogroup:member"],
205-
"dst": ["autogroup:self"],
206-
"ip": ["*"],
207-
},
208-
209102
// Allow members to use nodes as exit nodes and app connector
210103
{
211104
"src": ["group:superuser", "tag:k8s"],
212105
"dst": ["autogroup:internet"],
213106
"ip": ["*"],
214107
"via": ["tag:robbinsdale", "tag:ottawa"],
215108
},
216-
217-
// Allow tailscale logstream to access k8s nodes
218-
{
219-
"src": ["logstream@tailscale"],
220-
"dst": ["tag:k8s"],
221-
"ip": ["tcp:8088"],
222-
},
223-
224-
// ------------------------------------------------------------------------
225-
// SUBNET ROUTE ACCESS
226-
// ------------------------------------------------------------------------
227-
228109
// Access to subnets via subnet routers
229110
{
230-
"src": ["group:superuser", "tag:ottawa", "tag:usw2", "tag:robbinsdale"],
111+
"src": ["group:superuser", "tag:ottawa", "tag:stpetersburg"],
231112
"dst": ["ipset:robbinsdale"],
232113
"ip": ["*"],
233114
"via": ["tag:robbinsdale"],
234115
},
235116
{
236-
"src": ["tag:ottawa-infra", "ipset:ottawa"],
237-
"dst": ["ipset:usw2"],
238-
"ip": ["*"],
239-
"via": ["tag:usw2"],
240-
},
241-
{
242-
"src": ["group:superuser", "tag:robbinsdale", "tag:usw2", "tag:ottawa"],
117+
"src": ["group:superuser", "tag:robbinsdale", "tag:stpetersburg"],
243118
"dst": ["ipset:ottawa"],
244119
"ip": ["*"],
245120
"via": ["tag:ottawa"],
246121
},
247122
{
248-
"src": ["group:superuser"],
123+
"src": ["group:superuser", "tag:robbinsdale", "tag:ottawa"],
249124
"dst": ["ipset:stpetersburg"],
250125
"ip": ["*"],
251126
"via": ["tag:stpetersburg"],
252127
},
253-
254-
// ------------------------------------------------------------------------
255-
// KUBERNETES
256-
// ------------------------------------------------------------------------
257-
258128
// Admin access to Kubernetes API with system:masters privileges
259129
{
260130
"src": ["group:superuser", "tag:k8s"],
261-
"dst": ["tag:k8s","tag:k8s-operator"],
131+
"dst": ["tag:k8s-operator", "tag:k8s"],
262132
"ip": ["*"],
263133
"app": {
264134
"tailscale.com/cap/kubernetes": [
@@ -277,11 +147,10 @@
277147
],
278148
},
279149
},
280-
281150
// Member access to Kubernetes API with read-only privileges
282151
{
283152
"src": ["autogroup:member"],
284-
"dst": ["tag:k8s","tag:k8s-operator"],
153+
"dst": ["tag:k8s-operator","tag:k8s"],
285154
"ip": ["*"],
286155
"app": {
287156
"tailscale.com/cap/kubernetes": [
@@ -296,11 +165,6 @@
296165
},
297166
},
298167
],
299-
300-
// ============================================================================
301-
// NODE ATTRIBUTES & CAPABILITIES
302-
// ============================================================================
303-
304168
"nodeAttrs": [
305169
{
306170
"target": ["*"],
@@ -346,18 +210,7 @@
346210
// "only-tcp-443",
347211
],
348212
},
349-
350-
// Restricted outbound configuration
351-
{
352-
"target": ["tag:restricted-outbound"],
353-
"attr": ["only-tcp-443"],
354-
},
355213
],
356-
357-
// ============================================================================
358-
// Test ACLs
359-
// ============================================================================
360-
361214
// Define test ACLs
362215
"tests": [
363216
{
@@ -378,13 +231,6 @@
378231
"rajsinghtech@github:53",
379232
]
380233
},
381-
{
382-
// K8s operator user test ACLs
383-
"src": "tag:k8s-operator",
384-
"accept": [
385-
"tag:k8s:443",
386-
]
387-
},
388234
{
389235
// K8s user
390236
"src": "tag:k8s",
@@ -398,32 +244,22 @@
398244
"src": "tag:robbinsdale",
399245
"accept": [
400246
"192.168.169.1:443",
401-
"192.168.50.1:443",
402247
],
248+
"deny": [
249+
"192.168.50.1:443",
250+
]
403251
},
404252
{
405253
// Ottawa cannot reach it's own LAN
406254
"src": "tag:ottawa",
407255
"accept": [
408256
"192.168.50.1:443",
409-
"192.168.169.1:443",
410-
"192.168.169.114:6443",
411-
],
412-
},
413-
{
414-
// Tailscale Access
415-
"src": "logstream@tailscale",
416-
"accept": [
417-
"tag:k8s:8088",
418257
],
258+
"deny": [
259+
"192.168.169.1:443",
260+
]
419261
},
420262
],
421-
422-
423-
// ============================================================================
424-
// LEGACY CONFIGURATION (DEPRECATED)
425-
// ============================================================================
426-
427263
// Legacy ACL rules (deprecated - using grants instead)
428264
"acls": [{
429265
// Private log streaming enables audit and network logs to be directly

0 commit comments

Comments
 (0)