Viewing profile — submitaticket

Long enough to authenticate the node into the Tailnet. Short enough to revoke itself before the Agent can use it.

Not the quickest win if you're spinning up ephemeral runners for CI.

Where is he preaching the religion of short-living credentials. He literally agrees with the high cost/friction to implement. > Unfortunately, dynamic credentials are a lot of work…

It would not have prevented the initial exploit. The agent gained access to the K8s cluster and read the Tailscale Auth Key from Cluster Secrets. A short-lived credential would red…