rsp2k/headscale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

types/node, policy/v2: drop taildrive caps from baseline emission

Browse source 
Taildrive (drive:share and drive:access) is policy-driven per
Tailscale's documented behaviour
(https://tailscale.com/docs/features/taildrive). The previous
always-on baseline emission diverged from SaaS for every node not
targeted by a drive nodeAttr -- a real semantic divergence that the
compat suite caught once the test moved to comparing TailNode output
against the captured netmaps.

types.Node.TailNode no longer stamps the drive pair. Operators
wanting taildrive add a nodeAttrs entry:

  "nodeAttrs": [
    { "target": ["*"], "attr": ["drive:share", "drive:access"] }
  ]

unmodelledTailnetStateCaps shrinks accordingly. The baseline-divergence
group is gone; every entry left in the list is genuinely unmodelled
(user-role caps, unimplemented features, tailnet metadata, internal
tuning).

servertest's TestNodeAttrsBaselineCapsAlwaysOn expects the smaller
baseline (admin + ssh + file-sharing). Integration TestGrantCapDrive
grants the drive caps explicitly via NodeAttrs to exercise the
policy-driven emission path.
This commit is contained in:
Kristoffer Dalby 2026-05-11 14:54:03 +00:00
parent 5ebc53c29e
commit 8ea4cd3faa
5 changed files with 42 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

12
hscontrol/servertest/nodeattrs_test.go
View file

@ -166,10 +166,12 @@ func TestNodeAttrsRevokesWhenRemoved(t *testing.T) {
}
// TestNodeAttrsBaselineCapsAlwaysOn verifies that the SaaS-baseline caps
// (Admin, SSH, FileSharing, Taildrive share/access) are emitted on every
// node regardless of whether the policy mentions them. Tailscale clients
// expect these to be present, and Tailscale SaaS emits them
// unconditionally; headscale matches that shape.
// (Admin, SSH, FileSharing) are emitted on every node regardless of
// whether the policy mentions them. Tailscale SaaS emits these
// unconditionally for default tailnet settings; headscale matches that
// shape. Taildrive (drive:share / drive:access) is policy-driven per
// Tailscale's docs and is verified through TestNodeAttrsAddsToBaseline
// and the integration TestGrantCapDrive flow.
func TestNodeAttrsBaselineCapsAlwaysOn(t *testing.T) {
t.Parallel()
@ -187,8 +189,6 @@ func TestNodeAttrsBaselineCapsAlwaysOn(t *testing.T) {
tailcfg.CapabilityAdmin,
tailcfg.CapabilitySSH,
tailcfg.CapabilityFileSharing,
tailcfg.NodeAttrsTaildriveShare,
tailcfg.NodeAttrsTaildriveAccess,
} {
if !hasCap(nm, w) {
return false