Skip to content

docs(networking): document sandbox cluster access #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jmgilman merged 1 commit into from
Aug 26, 2026
Merged

docs(networking): document sandbox cluster access #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions docs/docs/designs/lab-v2-core-network.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,9 +149,10 @@ The baseline policy permits:
- approved home and Tailscale administration sources to management and OOB;
- required management flows from management to managed lab endpoints;
- internet egress from management and sandbox/workload;
- sandbox/workload access to management;
- explicit `glab.lol` mirror traffic.

The sandbox/workload VLAN cannot initiate connections to management or OOB.
The sandbox/workload VLAN cannot initiate connections to OOB or home networks.
Each additional flow identifies its source, destination, protocol, destination
port, direction, and owner in the version-controlled gateway policy.

Expand Down Expand Up @@ -261,7 +262,8 @@ A deployment is valid when:
- home-to-lab traffic retains its home source address;
- lab-to-internet traffic uses the `gw01` source-NAT address;
- each permitted firewall flow succeeds and each denied flow fails;
- the sandbox cannot initiate management or OOB connections;
- the sandbox can initiate management connections but cannot initiate OOB or
home connections;
- each MS-02 retains management when its AMT link is disconnected and retains
AMT when its management link is disconnected;
- no BGP peers or retired gateway services remain;
Expand Down
14 changes: 14 additions & 0 deletions docs/docs/reference/networking/tailscale-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ and trailing commas. Section syntax is documented in Tailscale's
| Tag | Purpose | Owner |
| --- | --- | --- |
| `tag:subnet-router` | Devices that advertise lab and home subnet routes into the tailnet | `autogroup:admin` |
| `tag:sandbox` | Sandbox hosts that accept advertised lab subnet routes | `autogroup:admin` |

A tagged device is owned by its tag, not by the user who registered it. Removing
a tag from the policy while a device still carries it leaves that device without
Expand All @@ -63,6 +64,19 @@ manual approval:
The [network address and VLAN plan](address-plan.md) is canonical for lab
prefixes. Reconcile this list whenever that plan changes.

## Access rules

`tag:sandbox` can reach the Incus cluster API through the advertised lab subnet
route:

| Destinations | Protocol | Port |
| --- | --- | --- |
| `10.10.10.11`–`10.10.10.14` | TCP | `8443` |

Policy tests require access to all four API endpoints and deny adjacent
addresses and ports. Other routed destinations remain denied unless a separate
rule permits them.

## Credentials

CI authenticates with a Tailscale
Expand Down