FR: Add Data Sources and Resources for Tailscale Tags

[jimrazmus]

Is your feature request related to a problem? Please describe.
I want to manage the list of Tags available independent of device management. This would allow me to codify persistent Tags and subsequently use them with ephemeral devices.

Describe the solution you'd like

• Add tailscale_tag resource and data source
• Add tailscale_tags resource and data source

Additional context
Currently I am unable to utilize the Terraform provider for managing the Tags available to ephemeral devices.

[mpminardi]

Hey @jimrazmus! This is possible today using the tailscale_acl resource / data source to manage the policy file via terraform and including a tagOwners section.

For example, something like the below:

resource "tailscale_acl" "policy_file" {
  acl = <<EOF
  { 
    // Rest of the policy file omitted for brevity
    "tagOwners": {
      "tag:example": ["autogroup:admin"],
    },
  }
  EOF
}

would create a tag:example tag. Note that the entire policy file must be managed and specified via terraform here if you use the tailscale_acl resource.

Would this suffice for your usecase?

[rssnyder]

I for one am attempting to make a standalone tofu module for deploying the tailscale operator in a kubernetes cluster. To be able to manage individual tags, not my entire tailnet policy, would fit my use case better.

For example when trying to create an oauth key I get errors about tags not existing, it would be great to create them using the provider as well:

resource "tailscale_oauth_client" "operator" {
  description = "kubernetes operator for ${var.name}"
  scopes      = ["auth_keys", "devices:core", "devices:routes"]
  tags        = ["tag:${local.tailscale_tag}"]
}

results in

╷
│ Error: Failed to create oauth client
│
│   with tailscale_oauth_client.operator,
│   on tailscale.tf line 5, in resource "tailscale_oauth_client" "operator":
│    5: resource "tailscale_oauth_client" "operator" {
│
│ requested tags [tag:pve0-k8s-operator] are invalid or not permitted (400)
╵

I can see in the browser that there seems to be an endpoint for creating tags:

curl 'https://login.tailscale.com/admin/api/public/tailnet/-/acl/tags' \
  -X POST \
  --data-raw '{"name":"tag:pve0-k8s-operator","owners":[],"comment":""}'

There is also an API for retriving tags:

curl 'https://login.tailscale.com/admin/api/public/tailnet/-/acl/tags'

Managing tags this way (or any other sub-option in the ACL) would prevent you from managing the entire policy as one using the current acl resource, but thats a trade off users will have to make.