Skip to content

Latest commit

 

History

History
48 lines (33 loc) · 1.72 KB

README.md

File metadata and controls

48 lines (33 loc) · 1.72 KB

Tailscale JIT Access with GitHub Actions 🚀

This repository demonstrates how to implement Just-in-Time (JIT) access for Tailscale using GitHub Actions and GitOps ACLs. By leveraging Tailscale's ACLs stored in a Git repository, you can request and grant temporary access to specific users dynamically.

📌 How It Works

There are two different types of Just-in-Time (JIT) access requests in this repository:

  • Kubernetes Permission Request
  • Cloud Service Permission Request

Cloud Service Connection Diagram

graph LR
    A[Tailscale Client] --> B[Tailscale Connector]
    B -->|route to cloud service| C[MySQL-RDS 10.1.1.1]
    B -->|route to cloud service| D[PgSQL-RDS 10.2.2.2]
Loading
  1. User submits a request via GitHub Actions for JIT access.
  2. A GitHub Actions workflow automatically updates the ACL policy and create a pull request in your repository.
  3. Manual approval the pull request and the modified ACLs are committed and pushed to the Git repository, triggering Tailscale ACL updates.
  4. A GitHub scheduled job runs every 5 minutes to automatically revoke the expired permissions.

🛠️ Prerequisites

Before setting up JIT access, ensure you have setup GitOps ACLs with Tailscale.

📁 Project Directory Structure

This repository contains the following structure:

.
├── default.hujson
├── policy.hujson
└── jit/

  • default.hujson: This is the base Tailscale ACLs file.

  • policy.hujson: This file is the result of merging the default.hujson file with all files in the jit/ folder.

  • jit/: This folder is used to store files for just-in-time access requests.