From 55b96e52a527ad576680d0fb04641a5347e6b4f7 Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Fri, 11 Sep 2026 14:12:04 -0700 Subject: [PATCH] feat(tailscale): let tag:subnet-router own tag:sandbox --- tailscale/policy.hujson | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tailscale/policy.hujson b/tailscale/policy.hujson index c067c08..ffe31b6 100644 --- a/tailscale/policy.hujson +++ b/tailscale/policy.hujson @@ -9,10 +9,13 @@ // Reference: // https://github.com/GilmanLab/root/blob/master/docs/docs/reference/networking/tailscale-policy.md { - // Who may assign each tag to a device. + // Who may assign each tag to a device. tag:subnet-router also owns + // tag:sandbox so the OpenTofu-managed tailnet OAuth client (GilmanLab/aws + // network/tailscale, which holds tag:subnet-router) can mint federated + // identities that enroll ephemeral tag:sandbox CI nodes. "tagOwners": { "tag:subnet-router": ["autogroup:admin"], - "tag:sandbox": ["autogroup:admin"], + "tag:sandbox": ["autogroup:admin", "tag:subnet-router"], }, // Routes a subnet router may advertise without manual approval. These are