I suggested a change to have this action use only Workload Identity Federation, but in the meanwhile we followed the example in the docs and ended up with the following Github Workflow:

jobs:
  acls:
    permissions:
      contents: read
      id-token: write # IMPORTANT - required for generating an OIDC token
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: get OIDC token from GitHub Actions
        id: get_gh_oidc_token
        run: |
          OIDC_JWT=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${{ secrets.TS_OIDC_AUDIENCE }}" | jq -r '.value')
          echo "::add-mask::$OIDC_JWT"
          echo "jwt=$OIDC_JWT" >> $GITHUB_OUTPUT

      - name: perform OIDC token exchange
        id: tailscale_api_key
        run: |
          # Perform the OIDC token exchange with Tailscale
          RESPONSE=$(curl -X POST https://api.tailscale.com/api/v2/oauth/token-exchange \
            -H "Content-Type: application/x-www-form-urlencoded" \
            -d "client_id=${{ secrets.TS_OIDC_CLIENT_ID }}" \
            -d "jwt=${{ steps.get_gh_oidc_token.outputs.jwt }}")
          # make API request to demonstrate access token
          export ACCESS_TOKEN=$(echo $RESPONSE | jq -r '.access_token')
          echo "::add-mask::$ACCESS_TOKEN"
          echo "access_token=$ACCESS_TOKEN" >> $GITHUB_OUTPUT

      - name: Deploy ACL
        if: github.event_name == 'push'
        id: deploy-acl
        uses: tailscale/gitops-acl-action@v1
        with:
          api-key: ${{ steps.tailscale_api_key.outputs.access_token }}
          tailnet: ${{ secrets.TS_TAILNET }}
          action: apply


      - name: Test ACL
        if: github.event_name == 'pull_request'
        uses: tailscale/gitops-acl-action@v1
        with:
          api-key: ${{ steps.tailscale_api_key.outputs.access_token }}
          tailnet: ${{ secrets.TS_TAILNET }}
          action: test

Note you need to set TS_OIDC_CLIENT_ID and TS_OIDC_AUDIENCE secrets per the values you generate in the Trust Credentials page.

Add Workload Identity Federation Example #62

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions