Add Workload Identity Federation Example

[jason-riddle]

Please add an example how on to use this with the recent release of Workload Identity Federation.

See: https://tailscale.com/kb/1581/workload-identity-federation

[kobim]

I suggested a change to have this action use only Workload Identity Federation, but in the meanwhile we followed the example in the docs and ended up with the following Github Workflow:

jobs:
  acls:
    permissions:
      contents: read
      id-token: write # IMPORTANT - required for generating an OIDC token
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: get OIDC token from GitHub Actions
        id: get_gh_oidc_token
        run: |
          OIDC_JWT=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${{ secrets.TS_OIDC_AUDIENCE }}" | jq -r '.value')
          echo "::add-mask::$OIDC_JWT"
          echo "jwt=$OIDC_JWT" >> $GITHUB_OUTPUT

      - name: perform OIDC token exchange
        id: tailscale_api_key
        run: |
          # Perform the OIDC token exchange with Tailscale
          RESPONSE=$(curl -X POST https://api.tailscale.com/api/v2/oauth/token-exchange \
            -H "Content-Type: application/x-www-form-urlencoded" \
            -d "client_id=${{ secrets.TS_OIDC_CLIENT_ID }}" \
            -d "jwt=${{ steps.get_gh_oidc_token.outputs.jwt }}")
          # make API request to demonstrate access token
          export ACCESS_TOKEN=$(echo $RESPONSE | jq -r '.access_token')
          echo "::add-mask::$ACCESS_TOKEN"
          echo "access_token=$ACCESS_TOKEN" >> $GITHUB_OUTPUT

      - name: Deploy ACL
        if: github.event_name == 'push'
        id: deploy-acl
        uses: tailscale/gitops-acl-action@v1
        with:
          api-key: ${{ steps.tailscale_api_key.outputs.access_token }}
          tailnet: ${{ secrets.TS_TAILNET }}
          action: apply


      - name: Test ACL
        if: github.event_name == 'pull_request'
        uses: tailscale/gitops-acl-action@v1
        with:
          api-key: ${{ steps.tailscale_api_key.outputs.access_token }}
          tailnet: ${{ secrets.TS_TAILNET }}
          action: test

Note you need to set TS_OIDC_CLIENT_ID and TS_OIDC_AUDIENCE secrets per the values you generate in the Trust Credentials page.

[ciffelia]

I created a custom action to obtain access token:

https://github.com/ciffelia/tailscale-authenticate-action

name: Sync Tailscale ACLs

on:
  push:
    branches: [main]

jobs:
  sync-acls:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # required: enables GitHub's OIDC provider

    steps:
      - uses: actions/checkout@v5

      - name: Authenticate to Tailscale
        id: tailscale-auth
        uses: ciffelia/tailscale-authenticate-action@v1
        with:
          client-id: ${{ vars.TS_OIDC_CLIENT_ID }}
          audience: ${{ vars.TS_OIDC_AUDIENCE }}

      - name: Deploy ACLs
        uses: tailscale/gitops-acl-action@v1
        with:
          tailnet: "-"  # default tailnet of the access token
          api-key: ${{ steps.tailscale-auth.outputs.access-token }}
          action: apply

[mpminardi]

Hey folks! We've added an audience argument as of v1.5.1 that can be used with oauth-client-id to leverage workload identity federation and the getting started section in the README has been updated to show using workload identity federation.

[jaxxstorm]

I rewrote the action in typescript and added native identity federation support

https://github.com/jaxxstorm/action-tailscale-gitops-acl