mirror of https://github.com/tailscale/tailscale.git synced 2025-11-04 10:11:18 +01:00

History

Andrew Lytvynov 66aa774167

cmd/gitops-pusher: default previousEtag to controlEtag (#14296 )

If previousEtag is empty, then we assume control ACLs were not modified
manually and push the local ACLs. Instead, we defaulted to localEtag
which would be different if local ACLs were different from control.

AFAIK this was always buggy, but never reported?

Fixes #14295

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>

2024-12-05 15:00:54 -08:00

.gitignore

cmd/gitops-pusher: add etag cache file for the three version problem (#5124 )

2022-07-22 15:07:38 -04:00

cache.go

all: update copyright and license headers

2023-01-27 15:36:29 -08:00

gitops-pusher_test.go

cmd/gitops-pusher: re-use existing types from acl package

2023-07-19 14:44:45 -04:00

gitops-pusher.go

cmd/gitops-pusher: default previousEtag to controlEtag (#14296 )

2024-12-05 15:00:54 -08:00

README.md

.github,cmd/gitops-pusher: update to checkout@v4

2023-09-04 15:12:57 -07:00

README.md

gitops-pusher

This is a small tool to help people achieve a GitOps workflow with Tailscale ACL changes. This tool is intended to be used in a CI flow that looks like this:

name: Tailscale ACL syncing

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  acls:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Go environment
        uses: actions/setup-go@v3.2.0
        
      - name: Install gitops-pusher
        run: go install tailscale.com/cmd/gitops-pusher@latest
              
      - name: Deploy ACL
        if: github.event_name == 'push'
        env:
          TS_API_KEY: ${{ secrets.TS_API_KEY }}
          TS_TAILNET: ${{ secrets.TS_TAILNET }}
        run: |
          ~/go/bin/gitops-pusher --policy-file ./policy.hujson apply

      - name: ACL tests
        if: github.event_name == 'pull_request'
        env:
          TS_API_KEY: ${{ secrets.TS_API_KEY }}
          TS_TAILNET: ${{ secrets.TS_TAILNET }}
        run: |
          ~/go/bin/gitops-pusher --policy-file ./policy.hujson test

Change the value of the --policy-file flag to point to the policy file on disk. Policy files should be in HuJSON format.