feat(bastion): add support for app connectors, exit nodes, and configurable tags

provider/pkg/provider/aws/bastion.go

@@ -25,29 +25,31 @@ var (
 
 // The set of arguments for creating a Bastion component resource.
 type BastionArgs struct {
- VpcID pulumi.StringInput `pulumi:"vpcId"`
- SubnetIds pulumi.StringArrayInput `pulumi:"subnetIds"`
- TailscaleTags pulumi.StringArrayInput `pulumi:"tailscaleTags"`
- Route pulumi.StringInput `pulumi:"route"`
- Region pulumi.StringInput `pulumi:"region"`
- InstanceType pulumi.StringInput `pulumi:"instanceType"`
- HighAvailability bool `pulumi:"highAvailability"`
- EnableSSH bool `pulumi:"enableSSH"`
- Public bool `pulumi:"public"`
+ VpcID pulumi.StringInput `pulumi:"vpcId"`
+ SubnetIds pulumi.StringArrayInput `pulumi:"subnetIds"`
+ TailscaleTags pulumi.StringArrayInput `pulumi:"tailscaleTags"`
+ Route pulumi.StringInput `pulumi:"route"`
+ Region pulumi.StringInput `pulumi:"region"`
+ InstanceType pulumi.StringInput `pulumi:"instanceType"`
+ Hostname pulumi.StringInput `pulumi:"hostname"`
+ HighAvailability bool `pulumi:"highAvailability"`
+ EnableSSH bool `pulumi:"enableSSH"`
+ Public bool `pulumi:"public"`
+ EnableExitNode bool `pulumi:"enableExitNode"`
+ EnableAppConnector bool `pulumi:"enableAppConnector"`
 }
 
 type UserDataArgs struct {
- ParameterName string
- Route string
- Region string
- TailscaleTags []string
- EnableSSH bool
+ ParameterName string
+ Route string
+ Region string
+ TailscaleTags string
+ EnableSSH bool
+ EnableExitNode bool
+ EnableAppConnector bool
+ Hostname string
 }
 
-// Join the tags into a CSV
-func (uda *UserDataArgs) JoinedTags() string {
- return strings.Join(uda.TailscaleTags, ",")
-}
 
 // The Bastion component resource.
 type Bastion struct {
@@ -71,21 +73,31 @@ func NewBastion(ctx *pulumi.Context,
  return nil, err
  }
 
+ var hostname pulumi.StringInput
+
+ if args.Hostname == nil {
+ hostname = pulumi.String(name)
+ } else {
+ hostname = args.Hostname
+ }
+
  // create a tailnet key to auth devices
  tailnetKey, err := tailscale.NewTailnetKey(ctx, name, &tailscale.TailnetKeyArgs{
  Ephemeral: pulumi.Bool(true),
  Preauthorized: pulumi.Bool(true),
  Reusable: pulumi.Bool(true),
  Tags: args.TailscaleTags,
+ Description: pulumi.Sprintf("Auth key for %s", hostname),
  }, pulumi.Parent(component))
  if err != nil {
  return nil, fmt.Errorf("error creating tailnet key: %v", err)
  }
 
  // store the key in an AWS SSM parameter
  tailnetKeySsmParameter, err := ssm.NewParameter(ctx, name, &ssm.ParameterArgs{
- Type: ssm.ParameterTypeSecureString,
- Value: tailnetKey.Key,
+ Type: ssm.ParameterTypeSecureString,
+ Value: tailnetKey.Key,
+ Description: pulumi.Sprintf("Tailscale auth key for %s", hostname),
  }, pulumi.Parent(component))
  if err != nil {
  return nil, fmt.Errorf("error creating SSM parameter: %v", err)
@@ -263,14 +275,20 @@ func NewBastion(ctx *pulumi.Context,
  MostRecent: pulumi.BoolPtr(true),
  }, pulumi.Parent(component))
 
- data := pulumi.All(tailnetKeySsmParameter.Name, args.Route, args.Region, args.TailscaleTags, args.EnableSSH).ApplyT(
+ data := pulumi.All(tailnetKeySsmParameter.Name, args.Route, args.Region, args.TailscaleTags, args.EnableSSH, hostname, args.EnableExitNode, args.EnableAppConnector).ApplyT(
  func(args []interface{}) (string, error) {
+
+ tagCSV := strings.Join(args[3].([]string), ",")
+
  d := UserDataArgs{
- ParameterName: args[0].(string),
- Route: args[1].(string),
- Region: args[2].(string),
- TailscaleTags: args[3].([]string),
- EnableSSH: args[4].(bool),
+ ParameterName: args[0].(string),
+ Route: args[1].(string),
+ Region: args[2].(string),
+ TailscaleTags: tagCSV,
+ EnableSSH: args[4].(bool),
+ Hostname: args[5].(string),
+ EnableExitNode: args[6].(bool),
+ EnableAppConnector: args[7].(bool),
  }
 
  var userDataBytes bytes.Buffer
@@ -309,8 +327,6 @@ func NewBastion(ctx *pulumi.Context,
  PublicKey: key.PublicKeyOpenssh,
  }, pulumi.Parent(component))
 
-
-
  launchConfiguration, err := ec2.NewLaunchConfiguration(ctx, name, &ec2.LaunchConfigurationArgs{
  InstanceType: instanceType,
  AssociatePublicIpAddress: pulumi.Bool(args.Public),
@@ -334,13 +350,27 @@ func NewBastion(ctx *pulumi.Context,
  size = 1
  }
 
+ var instanceRefresh autoscaling.GroupInstanceRefreshPtrInput
+ if args.HighAvailability {
+ instanceRefresh = autoscaling.GroupInstanceRefreshArgs{
+ Strategy: pulumi.String("Rolling"),
+ Preferences: autoscaling.GroupInstanceRefreshPreferencesArgs{
+ MinHealthyPercentage: pulumi.Int(50),
+ },
+ }
+
+ } else {
+ instanceRefresh = nil
+ }
+
  asg, err := autoscaling.NewGroup(ctx, name, &autoscaling.GroupArgs{
  LaunchConfiguration: launchConfiguration.ID(),
  MaxSize: pulumi.Int(size),
  MinSize: pulumi.Int(size),
  HealthCheckType: pulumi.String("EC2"),
  HealthCheckGracePeriod: pulumi.Int(30),
  VpcZoneIdentifiers: args.SubnetIds,
+ InstanceRefresh: instanceRefresh,
  Tags: autoscaling.GroupTagArray{
  autoscaling.GroupTagArgs{
  Key: pulumi.String("Name"),

provider/pkg/provider/aws/userdata.tmpl

@@ -18,4 +18,4 @@ sudo yum-config-manager --add-repo https://pkgs.tailscale.com/stable/amazon-linu
 sudo yum install tailscale -y
 sudo systemctl enable --now tailscaled
 sleep 10
-sudo tailscale up --ssh="{{ .EnableSSH }}" --advertise-tags=tag:bastion --advertise-routes="{{ .Route }}" --authkey=$(aws ssm get-parameter --name {{.ParameterName}} --region {{.Region}} --with-decryption | jq .Parameter.Value -r) --host-routes
+sudo tailscale up --advertise-connector="{{ .EnableAppConnector }}" --advertise-exit-node="{{ .EnableExitNode }}" --hostname="{{ .Hostname}}" --ssh="{{ .EnableSSH }}" --advertise-tags="{{ .TailscaleTags}}" --advertise-routes="{{ .Route }}" --authkey=$(aws ssm get-parameter --name {{.ParameterName}} --region {{.Region}} --with-decryption | jq .Parameter.Value -r) --host-routes

schema.yaml

@@ -58,6 +58,9 @@ resources:
  tailscale-bastion:aws:Bastion:
  isComponent: true
  inputProperties:
+ hostname:
+ type: string
+ description: "The hostname of the bastion."
  public:
  type: boolean
  description: "Whether the bastion is going in public subnets."
@@ -66,6 +69,14 @@ resources:
  type: boolean
  description: "Whether to enable SSH access to the bastion."
  default: true
+ enableAppConnector:
+ type: boolean
+ description: "Whether the bastion advertises itself as an app connector."
+ default: false
+ enableExitNode:
+ type: boolean
+ description: "Whether the subnet router can advertise itself as an exit node."
+ default: false
  highAvailability:
  type: boolean
  description: "Whether the bastion should be highly available."

sdk/dotnet/TailscaleBastion/Aws/Bastion.cs

@@ -54,6 +54,18 @@ private static ComponentResourceOptions MakeResourceOptions(ComponentResourceOpt
 
  public sealed class BastionArgs : global::Pulumi.ResourceArgs
  {
+ /// <summary>
+ /// Whether the bastion advertises itself as an app connector.
+ /// </summary>
+ [Input("enableAppConnector")]
+ public Input<bool>? EnableAppConnector { get; set; }
+
+ /// <summary>
+ /// Whether the subnet router can advertise itself as an exit node.
+ /// </summary>
+ [Input("enableExitNode")]
+ public Input<bool>? EnableExitNode { get; set; }
+
  /// <summary>
  /// Whether to enable SSH access to the bastion.
  /// </summary>
@@ -66,6 +78,12 @@ public sealed class BastionArgs : global::Pulumi.ResourceArgs
  [Input("highAvailability", required: true)]
  public Input<bool> HighAvailability { get; set; } = null!;
 
+ /// <summary>
+ /// The hostname of the bastion.
+ /// </summary>
+ [Input("hostname")]
+ public Input<string>? Hostname { get; set; }
+
  /// <summary>
  /// The EC2 instance type to use for the bastion.
  /// </summary>
@@ -122,6 +140,8 @@ public InputList<string> TailscaleTags
 
  public BastionArgs()
  {
+ EnableAppConnector = false;
+ EnableExitNode = false;
  EnableSSH = true;
  HighAvailability = false;
  Public = false;

sdk/nodejs/aws/bastion.ts

@@ -57,8 +57,11 @@ export class Bastion extends pulumi.ComponentResource {
  if ((!args || args.vpcId === undefined) && !opts.urn) {
  throw new Error("Missing required property 'vpcId'");
  }
+ resourceInputs["enableAppConnector"] = (args ? args.enableAppConnector : undefined) ?? false;
+ resourceInputs["enableExitNode"] = (args ? args.enableExitNode : undefined) ?? false;
  resourceInputs["enableSSH"] = (args ? args.enableSSH : undefined) ?? true;
  resourceInputs["highAvailability"] = (args ? args.highAvailability : undefined) ?? false;
+ resourceInputs["hostname"] = args ? args.hostname : undefined;
  resourceInputs["instanceType"] = args ? args.instanceType : undefined;
  resourceInputs["public"] = (args ? args.public : undefined) ?? false;
  resourceInputs["region"] = args ? args.region : undefined;
@@ -81,6 +84,14 @@ export class Bastion extends pulumi.ComponentResource {
  * The set of arguments for constructing a Bastion resource.
  */
 export interface BastionArgs {
+ /**
+ * Whether the bastion advertises itself as an app connector.
+ */
+ enableAppConnector?: pulumi.Input<boolean>;
+ /**
+ * Whether the subnet router can advertise itself as an exit node.
+ */
+ enableExitNode?: pulumi.Input<boolean>;
  /**
  * Whether to enable SSH access to the bastion.
  */
@@ -89,6 +100,10 @@ export interface BastionArgs {
  * Whether the bastion should be highly available.
  */
  highAvailability: pulumi.Input<boolean>;
+ /**
+ * The hostname of the bastion.
+ */
+ hostname?: pulumi.Input<string>;
  /**
  * The EC2 instance type to use for the bastion.
  */