spire-tailscale-plugin

README

SPIRE Tailscale Plugin

This repository contains agent and server plugins for SPIRE to allow Tailscale node attestation.

Quick Start

Before starting, create a running SPIRE deployment and add the following configuration to the agent and server. Both server and agents should be running on a Tailscale node.

Agent Configuration

NodeAttestor "tailscale" {
	plugin_cmd = "/path/to/plugin_cmd"
	plugin_checksum = "sha256 of the plugin binary"
	plugin_data {
	}
}

Server Configuration

NodeAttestor "tailscale" {
	plugin_cmd = "/path/to/plugin_cmd"
	plugin_checksum = "sha256 of the plugin binary"
	plugin_data {
	}
}

How it Works

The plugin uses the Tailscale Node public keys as the method of attestation and is inspired on the client verification in custom DERP servers. The plugin operates as follows:

1. Agent fetches the Tailscale Node key from the local tailscaled agent
2. Agent sends the key to the server
3. Server inspects the key and checks if it is a valid key in its Tailscale network.
4. Server creates a SPIFFE ID in the form of spiffe://<trust_domain>/spire/agent/ts/<hostname>
5. All done!