From bdce0494a2afa987bcd67e7c257b384989411c26 Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Tue, 25 Aug 2026 18:19:08 -0700 Subject: [PATCH] docs(networking): document sandbox cluster access --- docs/docs/designs/lab-v2-core-network.md | 6 ++++-- docs/docs/reference/networking/tailscale-policy.md | 14 ++++++++++++++ 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/docs/docs/designs/lab-v2-core-network.md b/docs/docs/designs/lab-v2-core-network.md index bbd148d..afc190a 100644 --- a/docs/docs/designs/lab-v2-core-network.md +++ b/docs/docs/designs/lab-v2-core-network.md @@ -149,9 +149,10 @@ The baseline policy permits: - approved home and Tailscale administration sources to management and OOB; - required management flows from management to managed lab endpoints; - internet egress from management and sandbox/workload; +- sandbox/workload access to management; - explicit `glab.lol` mirror traffic. -The sandbox/workload VLAN cannot initiate connections to management or OOB. +The sandbox/workload VLAN cannot initiate connections to OOB or home networks. Each additional flow identifies its source, destination, protocol, destination port, direction, and owner in the version-controlled gateway policy. @@ -261,7 +262,8 @@ A deployment is valid when: - home-to-lab traffic retains its home source address; - lab-to-internet traffic uses the `gw01` source-NAT address; - each permitted firewall flow succeeds and each denied flow fails; -- the sandbox cannot initiate management or OOB connections; +- the sandbox can initiate management connections but cannot initiate OOB or + home connections; - each MS-02 retains management when its AMT link is disconnected and retains AMT when its management link is disconnected; - no BGP peers or retired gateway services remain; diff --git a/docs/docs/reference/networking/tailscale-policy.md b/docs/docs/reference/networking/tailscale-policy.md index d041f0f..a137f09 100644 --- a/docs/docs/reference/networking/tailscale-policy.md +++ b/docs/docs/reference/networking/tailscale-policy.md @@ -42,6 +42,7 @@ and trailing commas. Section syntax is documented in Tailscale's | Tag | Purpose | Owner | | --- | --- | --- | | `tag:subnet-router` | Devices that advertise lab and home subnet routes into the tailnet | `autogroup:admin` | +| `tag:sandbox` | Sandbox hosts that accept advertised lab subnet routes | `autogroup:admin` | A tagged device is owned by its tag, not by the user who registered it. Removing a tag from the policy while a device still carries it leaves that device without @@ -63,6 +64,19 @@ manual approval: The [network address and VLAN plan](address-plan.md) is canonical for lab prefixes. Reconcile this list whenever that plan changes. +## Access rules + +`tag:sandbox` can reach the Incus cluster API through the advertised lab subnet +route: + +| Destinations | Protocol | Port | +| --- | --- | --- | +| `10.10.10.11`–`10.10.10.14` | TCP | `8443` | + +Policy tests require access to all four API endpoints and deny adjacent +addresses and ports. Other routed destinations remain denied unless a separate +rule permits them. + ## Credentials CI authenticates with a Tailscale