rsp2k/headscale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

policy/v2: add advertised routes to compat test topologies

Browse source 
Add routable_ips and approved_routes fields to the node topology
definitions in all golden test files. These represent the subnet
routes actually advertised by nodes on the Tailscale SaaS network
during data capture:

  Routes topology (92 files, 6 router nodes):
    big-router:     10.0.0.0/8
    subnet-router:  10.33.0.0/16
    ha-router1:     192.168.1.0/24
    ha-router2:     192.168.1.0/24
    multi-router:   172.16.0.0/24
    exit-node:      0.0.0.0/0, ::/0

  ACL topology (199 files, 1 router node):
    subnet-router:  10.33.0.0/16

  Grants topology (203 files, 1 router node):
    subnet-router:  10.33.0.0/16

The route assignments were deduced from the golden data by analyzing
which router nodes receive FilterRules for which destination CIDRs
across all test files, and cross-referenced with the MTS setup
script (setup_grant_nodes.sh).

Updates #2180
This commit is contained in:
Kristoffer Dalby 2026-03-18 13:40:19 +00:00
parent 927ce418d2
commit 995ed0187c
494 changed files with 76022 additions and 15770 deletions
Download patch file Download diff file Expand all files Collapse all files

160
hscontrol/policy/v2/testdata/grant_results/GRANT-V20.json vendored
View file

@ -50,7 +50,15 @@
{
"src": ["autogroup:member"],
"dst": ["tag:router"],
"app": { "tailscale.com/cap/kubernetes": [{ "impersonate": { "groups": ["system:masters"] } }] }
"app": {
"tailscale.com/cap/kubernetes": [
{
"impersonate": {
"groups": ["system:masters"]
}
}
]
}
}
],
"api_endpoint": "https://api.tailscale.com/api/v2/tailnet/kratail2tid%40passkey/acl",
@ -75,7 +83,9 @@
"user_id": 7489538288452506,
"tags": ["tag:router"],
"ipv4": "100.92.142.61",
"ipv6": "fd7a:115c:a1e0::3e37:8e3d"
"ipv6": "fd7a:115c:a1e0::3e37:8e3d",
"routable_ips": ["10.33.0.0/16"],
"approved_routes": ["10.33.0.0/16"]
},
"tagged-client": {
"mts_name": "tagged-client",
@ -197,7 +207,15 @@
"CapGrant": [
{
"Dsts": ["100.92.142.61/32", "fd7a:115c:a1e0::3e37:8e3d/128"],
"CapMap": { "tailscale.com/cap/kubernetes": [{ "impersonate": { "groups": ["system:masters"] } }] }
"CapMap": {
"tailscale.com/cap/kubernetes": [
{
"impersonate": {
"groups": ["system:masters"]
}
}
]
}
}
]
}
@ -219,12 +237,24 @@
{
"Dst": "100.92.142.61/32",
"Cap": "tailscale.com/cap/kubernetes",
"Values": [{ "impersonate": { "groups": ["system:masters"] } }]
"Values": [
{
"impersonate": {
"groups": ["system:masters"]
}
}
]
},
{
"Dst": "fd7a:115c:a1e0::3e37:8e3d/128",
"Cap": "tailscale.com/cap/kubernetes",
"Values": [{ "impersonate": { "groups": ["system:masters"] } }]
"Values": [
{
"impersonate": {
"groups": ["system:masters"]
}
}
]
}
]
}
@ -276,8 +306,14 @@
"OS": "linux",
"Hostname": "user-kris",
"Services": [
{ "Proto": "peerapi4", "Port": 40159 },
{ "Proto": "peerapi6", "Port": 40159 }
{
"Proto": "peerapi4",
"Port": 40159
},
{
"Proto": "peerapi6",
"Port": 40159
}
]
},
"Created": "2026-02-20T14:09:34.803901523Z",
@ -286,8 +322,20 @@
"ComputedName": "user-kris",
"ComputedNameWithHost": "user-kris"
},
"UserProfile": { "ID": 4538565228176803, "LoginName": "kristoffer@dalby.cc", "DisplayName": "kristoffer" },
"CapMap": { "tailscale.com/cap/kubernetes": [{ "impersonate": { "groups": ["system:masters"] } }] }
"UserProfile": {
"ID": 4538565228176803,
"LoginName": "kristoffer@dalby.cc",
"DisplayName": "kristoffer"
},
"CapMap": {
"tailscale.com/cap/kubernetes": [
{
"impersonate": {
"groups": ["system:masters"]
}
}
]
}
}
},
"100.103.90.82": {
@ -316,8 +364,14 @@
"OS": "linux",
"Hostname": "user-mon",
"Services": [
{ "Proto": "peerapi4", "Port": 33201 },
{ "Proto": "peerapi6", "Port": 33201 }
{
"Proto": "peerapi4",
"Port": 33201
},
{
"Proto": "peerapi6",
"Port": 33201
}
]
},
"Created": "2026-02-20T14:09:00.203639664Z",
@ -331,7 +385,15 @@
"LoginName": "monitorpasskeykradalby@passkey",
"DisplayName": "monitorpasskeykradalby"
},
"CapMap": { "tailscale.com/cap/kubernetes": [{ "impersonate": { "groups": ["system:masters"] } }] }
"CapMap": {
"tailscale.com/cap/kubernetes": [
{
"impersonate": {
"groups": ["system:masters"]
}
}
]
}
}
},
"100.90.199.68": {
@ -360,8 +422,14 @@
"OS": "linux",
"Hostname": "user1",
"Services": [
{ "Proto": "peerapi4", "Port": 46708 },
{ "Proto": "peerapi6", "Port": 46708 }
{
"Proto": "peerapi4",
"Port": 46708
},
{
"Proto": "peerapi6",
"Port": 46708
}
]
},
"Created": "2026-01-23T10:04:13.531671894Z",
@ -370,8 +438,20 @@
"ComputedName": "user1",
"ComputedNameWithHost": "user1"
},
"UserProfile": { "ID": 4156223528223174, "LoginName": "kratail2tid@passkey", "DisplayName": "kratail2tid" },
"CapMap": { "tailscale.com/cap/kubernetes": [{ "impersonate": { "groups": ["system:masters"] } }] }
"UserProfile": {
"ID": 4156223528223174,
"LoginName": "kratail2tid@passkey",
"DisplayName": "kratail2tid"
},
"CapMap": {
"tailscale.com/cap/kubernetes": [
{
"impersonate": {
"groups": ["system:masters"]
}
}
]
}
}
}
}
@ -549,8 +629,14 @@
"OS": "linux",
"Hostname": "subnet-router",
"Services": [
{ "Proto": "peerapi4", "Port": 63250 },
{ "Proto": "peerapi6", "Port": 63250 }
{
"Proto": "peerapi4",
"Port": 63250
},
{
"Proto": "peerapi6",
"Port": 63250
}
]
},
"Created": "2026-02-23T00:13:15.731478784Z",
@ -560,7 +646,11 @@
"ComputedName": "subnet-router",
"ComputedNameWithHost": "subnet-router"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},
@ -629,8 +719,14 @@
"OS": "linux",
"Hostname": "subnet-router",
"Services": [
{ "Proto": "peerapi4", "Port": 63250 },
{ "Proto": "peerapi6", "Port": 63250 }
{
"Proto": "peerapi4",
"Port": 63250
},
{
"Proto": "peerapi6",
"Port": 63250
}
]
},
"Created": "2026-02-23T00:13:15.731478784Z",
@ -640,7 +736,11 @@
"ComputedName": "subnet-router",
"ComputedNameWithHost": "subnet-router"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},
@ -709,8 +809,14 @@
"OS": "linux",
"Hostname": "subnet-router",
"Services": [
{ "Proto": "peerapi4", "Port": 63250 },
{ "Proto": "peerapi6", "Port": 63250 }
{
"Proto": "peerapi4",
"Port": 63250
},
{
"Proto": "peerapi6",
"Port": 63250
}
]
},
"Created": "2026-02-23T00:13:15.731478784Z",
@ -720,7 +826,11 @@
"ComputedName": "subnet-router",
"ComputedNameWithHost": "subnet-router"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},