Support OAuth or OIDC connectivity for Tailscale

[justin8]

Currently the tailscale extension requires an auth key, which has a maximum lifespan of 90 days and can be quite painful to manage. It'd be very useful for anyone using Tailscale with Talos to use either an OAuth clientId/clientSecret generated within Tailscale or identity federation via OIDC.

[astlock]

Actually, this is already supported because the Tailscale binary itself allows using an OAuth Client Secret directly in the --auth-key flag.

You can simply use your OAuth Client Secret into TS_AUTHKEY, no changes are needed.

https://tailscale.com/docs/features/oauth-clients#register-new-nodes-using-oauth-credentials

[justin8]

That is very unexpected, but at least it's simple and straightforward I suppose, I'll give it a go and maybe make a PR to update the documentation for the extension then.

[cfstras]

For reference, here's what I used to solve this:

1. Went to https://console.tailscale.com/admin/settings/trust-credentials
   1. Created an OAuth key with scope auth_keys (under keys, read/write, tags: tag:talos)
2. Added the ExtensionServiceConfig as below to my machine configs.

apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: tailscale
# https://login.tailscale.com/admin/settings/trust-credentials
# https://pkg.go.dev/tailscale.com@v1.96.4/cmd/containerboot

environment:
  # Required for OAuth keys (client_id/client_secret) to work
  # NOTE: All tags must be defined, and have "tag:talos" as owners to allow being used
  # https://login.tailscale.com/admin/acls/visual/tags
  - TS_EXTRA_ARGS=--advertise-tags=tag:talos

  - TS_AUTH_KEY=tskey-client-.....(your key here).....?ephemeral=true&preauthorized=true