Tailscale Config

Central credential authority for a Tailscale or Headscale tailnet.

tailscale-config is a workloadless charm that acts as the central credential authority for a charmed Tailscale/Headscale solution.

On relation to a downstream charm (tailscale-k8s or tailscale-beacon) it mints a scoped, per-downstream credential using the control-plane API (a child OAuth client for Tailscale, a pre-auth key for Headscale) and distributes it over a relation. On relation removal it revokes that credential. It holds no cluster or tailnet state beyond the root credential it needs to talk to the control-plane API, so it can run anywhere reachable, on or off the cluster.

A single tailscale-config is multi-tenant: it can serve many downstream charms across many models and clusters at once, minting an independent credential per relation. It is optional — downstream charms are fully functional standalone via manual config — but it is the recommended default at scale as it automates credential minting and revocation.

This charm is useful for platform teams operating charmed workloads that need to join a Tailscale or Headscale tailnet without managing per-workload credentials by hand.