Auto-approve container bridge subnet route for CI runners #27

Merged

AlexCaswen merged 2 commits from ci-container-subnet-route into main

2026-05-07 06:12:13 +00:00

AlexCaswen commented

2026-05-07 06:06:30 +00:00

(Migrated from gitlab.com)

What

Enables the container bridge subnet (10.121.25.0/24) as a Tailscale subnet route, allowing CI runners and other tailnet devices to reach containers directly.

Fixes the context deadline exceeded error in !26 where CI runners couldn't reach local Grafana at 10.121.25.50:3000.

Changes

acl.hujson:

Add 10.121.25.0/24 to autoApprovers.routes for tag:m3

incus.tf:

Add data.tailscale_device.m3_incus_os to look up the IncusOS host
Add tailscale_device_subnet_routes.container_bridge to approve 10.121.25.0/24

Device-side requirement

The Tailscale provider can only approve routes — the device must advertise them. Ensure the IncusOS host is configured to advertise:

tailscale set --advertise-routes=10.121.25.0/24

Once advertised, the autoApprovers ACL and tailscale_device_subnet_routes resource both ensure approval.

Security

Only tag:m3 devices can advertise this route. The tag:ci grant already allows CI to reach tag:m3 on all ports — this just makes the container IPs routable.

## What Enables the container bridge subnet (`10.121.25.0/24`) as a Tailscale subnet route, allowing CI runners and other tailnet devices to reach containers directly. Fixes the `context deadline exceeded` error in !26 where CI runners couldn't reach local Grafana at `10.121.25.50:3000`. ## Changes **acl.hujson:** - Add `10.121.25.0/24` to `autoApprovers.routes` for `tag:m3` **incus.tf:** - Add `data.tailscale_device.m3_incus_os` to look up the IncusOS host - Add `tailscale_device_subnet_routes.container_bridge` to approve `10.121.25.0/24` ## Device-side requirement The Tailscale provider can only approve routes — the device must advertise them. Ensure the IncusOS host is configured to advertise: ``` tailscale set --advertise-routes=10.121.25.0/24 ``` Once advertised, the `autoApprovers` ACL and `tailscale_device_subnet_routes` resource both ensure approval. ## Security Only `tag:m3` devices can advertise this route. The `tag:ci` grant already allows CI to reach `tag:m3` on all ports — this just makes the container IPs routable.

AlexCaswen commented

2026-05-07 06:09:08 +00:00

(Migrated from gitlab.com)

added 1 commit

d4656ad3 - Add Tailscale subnet route approval for container bridge

Compare with previous version

added 1 commit <ul><li>d4656ad3 - Add Tailscale subnet route approval for container bridge</li></ul> [Compare with previous version](/AlexCaswen/m3-infra/-/merge_requests/27/diffs?diff_id=1787073760&start_sha=64a31a19b13c2923ce0d4770c971f2b57b2b4360)

AlexCaswen commented

2026-05-07 06:09:24 +00:00

(Migrated from gitlab.com)

changed the description