Skip to content

Commit b551095

Browse files
jmgilmanjmgilman
authored
feat: adds support for configuring Tailscale (#175)
1 parent 7567096 commit b551095

File tree

7 files changed

+175
-12
lines changed

7 files changed

+175
-12
lines changed

‎actions/install-local/action.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,37 @@ runs:
7272
EOF
7373
7474
echo "::add-mask::$(echo "$SECRET" | jq -r .SecretString | jq -r .host)"
75+
- name: Get Tailscale configuration
76+
if: steps.cache-binary.outputs.cache-hit == false
77+
id: tailscale
78+
shell: bash
79+
run: |
80+
TAILSCALE=$(cue export -e global.ci.providers.tailscale ./blueprint.cue)
81+
CREDS=$(cue export -e global.ci.providers.tailscale.credentials ./blueprint.cue)
82+
SECRET_ID=$(echo "$CREDS" | jq -r .path)
83+
SECRET=$(aws secretsmanager get-secret-value --secret-id "$SECRET_ID")
84+
85+
TAGS="$(echo $TAILSCALE | jq -r .tags)"
86+
VERSION="$(echo $TAILSCALE | jq -r .version)"
87+
CLIENT_ID="$(echo $SECRET | jq -r .SecretString | jq -r .client_id)"
88+
CLIENT_SECRET="$(echo $SECRET | jq -r .SecretString | jq -r .client_secret)"
89+
90+
echo "::add-mask::$CLIENT_ID"
91+
echo "::add-mask::$CLIENT_SECRET"
92+
93+
echo "client-id=$CLIENT_ID" >> $GITHUB_OUTPUT
94+
echo "client-secret=$CLIENT_SECRET" >> $GITHUB_OUTPUT
95+
echo "tags=$TAGS" >> $GITHUB_OUTPUT
96+
echo "version=$VERSION" >> $GITHUB_OUTPUT
97+
- name: Install and configure Tailscale
98+
if: steps.cache-binary.outputs.cache-hit == false
99+
uses: tailscale/github-action@v3
100+
with:
101+
oauth-client-id: "${{ steps.tailscale.outputs.client-id }}"
102+
oauth-secret: "${{ steps.tailscale.outputs.client-secret }}"
103+
tags: "${{ steps.tailscale.outputs.tags }}"
104+
use-cache: "true"
105+
version: "${{ steps.tailscale.outputs.version }}"
75106
- name: Build Forge CLI
76107
if: steps.cache-binary.outputs.cache-hit == false
77108
shell: bash

‎actions/setup/README.md‎

Lines changed: 49 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,11 @@ ci: {
1919
role: "arn:aws:iam::123456:role/ci"
2020
}
2121
earthly: {
22-
credentials: {
22+
satellite: credentials: {
2323
provider: "aws"
2424
path: "path/to/secret"
2525
}
26-
org: "myorg"
27-
satellite: "sat"
26+
version: "latest"
2827
}
2928
}
3029
}
@@ -52,10 +51,32 @@ jobs:
5251
5352
The action will then perform the following:
5453
55-
1. Install the latest version of the Forge CLI
56-
2. Authenticate to AWS via OIDC
57-
3. Authenticate to Earthly Cloud using the credentials in the AWS Secrets Manager secret stored at `path/to/secret`
58-
4. Set the default Earthly Cloud organization to `myorg`
54+
1. **AWS Provider Setup** (if configured):
55+
- Authenticate to AWS using OIDC with the configured role
56+
- Login to Amazon ECR if a registry is specified
57+
58+
2. **Docker Provider Setup** (if configured):
59+
- Login to Docker Hub using credentials from the configured secret
60+
61+
3. **GitHub Provider Setup** (if configured):
62+
- Login to GitHub Container Registry (ghcr.io) using the GitHub token
63+
64+
4. **Earthly Provider Setup** (if configured):
65+
- Install Earthly CLI (latest or specified version)
66+
- Configure remote Earthly satellite authentication if credentials are provided
67+
68+
5. **Timoni Provider Setup** (if configured):
69+
- Install Timoni CLI with the specified version
70+
71+
6. **CUE Provider Setup** (if configured):
72+
- Install CUE CLI with the specified version
73+
74+
7. **KCL Provider Setup** (if configured):
75+
- Install KCL CLI with the specified version
76+
77+
8. **Tailscale Provider Setup** (if configured):
78+
- Install and configure Tailscale using OAuth2 credentials
79+
- Apply specified tags to the Tailscale node
5980
6081
### Configuring Providers
6182
@@ -70,7 +91,15 @@ The below list documents the expected format for each provider:
7091
- `username`: The username to login with
7192
- `password`: The password to login with
7293
1. Earthly
73-
- `token`: The Earthly Cloud token to login with
94+
- `ca_certificate`: Base64-encoded string containing the common CA certificate for mTLS
95+
- `certificate`: Base64 encoded string containing the (signed) client certificate used to authenticate with the satellite
96+
- `private_key`: Base64 encoded string containing the private key used to authenticate with the satellite
97+
- `host`: The address of the remote satellite in the form of `tcp://hostname:8372`
98+
1. Tailscale
99+
- `client_id`: The OAuth2 client ID used to authenticate with the Tailscale API
100+
- `client_secret`: The OAuth2 secret key used to authenticate with the Tailscale API
101+
1. GitHub
102+
- `token`: The access token used to authenticate with GitHub
74103

75104
If the secret uses a different format, the `maps` field of the secret can be used to map them correctly:
76105

@@ -103,7 +132,15 @@ Note that this _only_ works when run within the Catalyst Forge repository.
103132

104133
## Inputs
105134

106-
| Name | Description | Required | Default |
107-
| ------------- | ---------------------------------------- | -------- | ----------------------- |
108-
| forge_version | The version of the forge CLI to install | No | `"latest"` |
109-
| github_token | The GitHub token used for authentication | No | `"${{ github.token }}"` |
135+
| Name | Description | Required | Default |
136+
| ---------------------- | -------------------------------------------------------------------- | -------- | ----------------------- |
137+
| github_token | The GitHub token used for authentication | No | `"${{ github.token }}"` |
138+
| skip_aws | If true, skip authenticating with AWS and configuring ECR | No | `"false"` |
139+
| skip_cue | If true, skips installing CUE CLI if the provider is configured | No | `"false"` |
140+
| skip_docker | If true, skip authenticating to DockerHub | No | `"false"` |
141+
| skip_earthly_install | If true, skip installing Earthly | No | `"false"` |
142+
| skip_earthly_satellite | If true, skip adding authentication for the remote Earthly satellite | No | `"false"` |
143+
| skip_github | If true, skip authenticating to GitHub Container Registry | No | `"false"` |
144+
| skip_kcl | If true, skips installing KCL CLI if the provider is configured | No | `"false"` |
145+
| skip_tailscale | If true, skips installing and authenticating with skip_tailscale | No | `"false"` |
146+
| skip_timoni | If true, skips installing Timoni CLI if the provider is configured | No | `"false"` |

‎actions/setup/action.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ inputs:
3333
description: If true, skips installing KCL CLI if the provider is configured
3434
required: false
3535
default: "false"
36+
skip_tailscale:
37+
description: If true, skips installing and authenticating with skip_tailscale
38+
required: false
39+
default: "false"
3640
skip_timoni:
3741
description: If true, skips installing Timoni CLI if the provider is configured
3842
required: false
@@ -275,3 +279,52 @@ runs:
275279
shell: bash
276280
run: |
277281
kcl version
282+
283+
# Tailscale Provider
284+
- name: Get Tailscale provider configuration
285+
id: tailscale
286+
if: inputs.skip_tailscale == 'false'
287+
shell: bash
288+
run: |
289+
echo "==== Tailscale Setup ====="
290+
BP=$(forge dump .)
291+
292+
TAILSCALE=$(echo "$BP" | jq -r .global.ci.providers.tailscale)
293+
if [[ "$TAILSCALE" != "null" ]]; then
294+
CONFIGURED="true"
295+
VERSION=$(echo "$BP" | jq -r .global.ci.providers.tailscale.version)
296+
if [[ "$VERSION" == "null" ]]; then
297+
VERSION="latest"
298+
fi
299+
300+
TAGS=$(echo "$BP" | jq -r .global.ci.providers.tailscale.tags)
301+
if [[ "$TAGS" == "null" ]]; then
302+
TAGS=""
303+
fi
304+
305+
SECRET=$(forge secret get --project . global.ci.providers.tailscale.credentials)
306+
CLIENT_ID=$(echo "$SECRET" | jq -r .client_id)
307+
CLIENT_SECRET=$(echo "$SECRET" | jq -r .client_secret)
308+
309+
echo "::add-mask::$CLIENT_ID"
310+
echo "::add-mask::$CLIENT_SECRET"
311+
312+
echo "client-id=$CLIENT_ID" >> $GITHUB_OUTPUT
313+
echo "client-secret=$CLIENT_SECRET" >> $GITHUB_OUTPUT
314+
echo "tags=$TAGS" >> $GITHUB_OUTPUT
315+
echo "version=$VERSION" >> $GITHUB_OUTPUT
316+
else
317+
echo "Not configuring Tailscale"
318+
CONFIGURED="false"
319+
fi
320+
321+
echo "configured=$CONFIGURED" >> $GITHUB_OUTPUT
322+
- name: Install and configure Tailscale
323+
if: inputs.skip_tailscale == 'false' && steps.tailscale.outputs.configured == 'true'
324+
uses: tailscale/github-action@v3
325+
with:
326+
oauth-client-id: "${{ steps.tailscale.outputs.client-id }}"
327+
oauth-secret: "${{ steps.tailscale.outputs.client-secret }}"
328+
tags: "${{ steps.tailscale.outputs.tags }}"
329+
use-cache: "true"
330+
version: "${{ steps.tailscale.outputs.version }}"

‎blueprint.cue‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,15 @@ global: {
6060
]
6161
version: "v0.11.0"
6262
}
63+
64+
tailscale: {
65+
credentials: {
66+
provider: "aws"
67+
path: "global/ci/tailscale"
68+
}
69+
tags: "tag:cat-github"
70+
version: "latest"
71+
}
6372
}
6473
secrets: [
6574
{

‎lib/schema/blueprint/global/providers/cue_types_gen.go‎

Lines changed: 15 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/schema/blueprint/global/providers/main.cue‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ package providers
2222
// KCL contains the configuration for the KCL provider.
2323
kcl?: #KCL
2424

25+
// Tailscale contains the configuration for the Tailscale provider.
26+
tailscale?: #Tailscale
27+
2528
// Timoni contains the configuration for the Timoni provider.
2629
timoni?: #Timoni
2730
}

‎lib/schema/blueprint/global/providers/tailscale.cue‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
package providers
2+
3+
import "github.com/input-output-hk/catalyst-forge/lib/schema/blueprint/common"
4+
5+
#Tailscale: {
6+
// Credentials contains the OAuth2 credentials for authenticating to the
7+
// Tailscale network.
8+
credentials?: common.#Secret
9+
10+
// Tags is a comma-separated list of tags to impersonate.
11+
tags?: string
12+
13+
// Version contains the version of Tailscale to install.
14+
version?: string
15+
}

0 commit comments

Comments
 (0)