Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add name field to acl rules #230

Open
markwellis opened this issue Apr 25, 2023 · 1 comment
Open

Add name field to acl rules #230

markwellis opened this issue Apr 25, 2023 · 1 comment
Labels
enhancement New feature or request

Comments

@markwellis
Copy link
Contributor

markwellis commented Apr 25, 2023

Is your feature request related to a problem? Please describe.
I use terraform to add additional ACL rules by merging with the existing rules. Without a way of naming them there's no way to remove these rules automatically whilst preserving existing rules.

E.g.
If I have this array in terraform of acl rules that I will merge with the existing rules via a distinct(merge(old_rules, new_rules))

[
  {
    "action": "accept",
    "src": [
      "tag:foo"
    ],
    "dst": [
      "*:*"
    ]
  },
  {
    "action": "accept",
    "src": [
      "tag:bar"
    ],
    "dst": [
      "*:*"
    ]
  },
]

Some time later, I want to remove the second rule (src: tag:bar) from the acls, I can't just remove it from that array I have to do it manually in the tailscale admin interface.

If there was a name field I could name the rules with a prefix, e.g. tf-added-rule- and I could delete all the rules with that name prefix from old_rules before doing the merge(old_rules, new_rules)

Describe the solution you'd like
Add a name field to acl rules. This should be unique among the rules.

@markwellis markwellis added the enhancement New feature or request label Apr 25, 2023
@cyberbutler
Copy link

Commenting to support this feature request. Without a proper name or id attribute we cannot achieve idempotency easily using automation tooling. ACLs should be able to be modified in place without damaging existing rules. Additionally, it is my opinion that each ACL object block which is of type object(list(object)) should be able to have an id or name field added to each child object so that we can programmatically choose which rules to add or destroy including acls, tests, and ssh.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants