> ## Documentation Index
>
> Fetch the complete documentation index at: [/docs/llms.txt](/content/docs/llms.txt)
>
> Use this file to discover all available pages before exploring further.

[Skip to main content](/content/docs/integrations/tailscale#content-area/index.html)

Assistant

Responses are generated using AI and may contain mistakes.

Connect Namespace workloads to your Tailscale tailnet with workload identity federation.

Tailscale integration is currently supported for Linux workloads only.

Namespace relies on workload identity federation to connect your workloads to your Tailscale tailnet.
To get started, you need a Tailscale OIDC client ID and the set of tags that Namespace workloads
should advertise when they register.At runtime, Namespace issues a short-lived OpenID Connect ID token and uses it to register the
workload with your tailnet. No long-lived Tailscale auth key or client secret needs to be stored
in Namespace.

## [​](/content/docs/integrations/tailscale\#configure-tailscale/index.html)  Configure Tailscale

Use the Tailscale admin console to create the client ID that Namespace will store.

1

[Navigate to header](/content/docs/integrations/tailscale#create-an-openid-connect-trust-credential/index.html)

### Create an OpenID Connect trust credential

Open Tailscale’s [Trust credentials](https://login.tailscale.com/admin/settings/trust-credentials) page,
select **Credential**, then choose **OpenID Connect**.

2

[Navigate to header](/content/docs/integrations/tailscale#configure-namespace-as-the-issuer/index.html)

### Configure Namespace as the issuer

Configure the credential to trust Namespace’s OIDC issuer:

- **Issuer**: `Custom issuer`
- **Issuer URL**: `https://federation.namespaceapis.com`
- **Subject**: `<workspace-id>/*`

The subject pattern above allows workloads from one Namespace workspace to join your tailnet.
Namespace issues ID tokens with subjects in the form `<workspace-id>/<instance-id>` for workloads.You can find your workspace ID in [Workspace settings](https://cloud.namespace.so/workspace/settings).

3

[Navigate to header](/content/docs/integrations/tailscale#grant-node-registration-access-and-tags/index.html)

### Grant node-registration access and tags

Grant the credential the ability to register nodes and select the tags that Namespace workloads are allowed to advertise.
The tags you save in Namespace must be a subset of the tags allowed here.For Namespace-managed node registration, enable the scope that allows auth key generation for node joins:

- **Scope**: `auth_keys`
- **Tags**: every tag you plan to pass through `nsc integrations tailscale set --tag ...`

After you generate the credential, Tailscale shows both a **Client ID** and an **Audience**.
Namespace only needs the **Client ID**. It automatically requests an ID token with audience `api.tailscale.com/<client-id>`.

## [​](/content/docs/integrations/tailscale\#configure-the-integration-in-namespace/index.html)  Configure the integration in Namespace

Once you have the Tailscale client ID, store it in your Namespace workspace with a friendly name.You can do this from the [Integrations page](https://cloud.namespace.so/workspace/integrations) in the Namespace console, or with the CLI:

```
nsc integrations tailscale set corp --oauth-client-id <tailscale-client-id> --tag tag:namespace --tag tag:ci
```

This command creates or replaces the named spec `corp`.
The stored tags are the tags Namespace passes to `tailscale up --advertise-tags=...` when the workload joins your tailnet.You can pass tags either multiple times or as a comma-separated list:

```
nsc integrations tailscale set corp \
  --oauth-client-id <tailscale-client-id> \
  --tag tag:namespace,tag:ci
```

### [​](/content/docs/integrations/tailscale\#magic-dns/index.html)  Magic DNS

You can enable [Tailscale Magic DNS](https://tailscale.com/kb/1081/magicdns) so that workloads
can reach other devices on your tailnet by their machine name. To enable it, pass the `--enable-magic-dns` flag:

```
nsc integrations tailscale set corp \
  --oauth-client-id <tailscale-client-id> \
  --tag tag:namespace \
  --enable-magic-dns
```

You can also toggle Magic DNS directly from the [Integrations page](https://cloud.namespace.so/workspace/integrations).
To test that Magic DNS is working correctly you can perform a DNS lookup:

```
dig +search +short <device-name>
```

## [​](/content/docs/integrations/tailscale\#inspect-and-remove-specs/index.html)  Inspect And Remove Specs

List the currently configured Tailscale specs in your workspace:

```
nsc integrations tailscale list
```

To inspect the full machine-readable response instead, use JSON output:

```
nsc integrations tailscale list --output json
```

Remove a named spec when you no longer need it:

```
nsc integrations tailscale remove corp
```

## [​](/content/docs/integrations/tailscale\#how-namespace-uses-the-spec/index.html)  How Namespace Uses The Spec

When a Namespace workload uses one of these named specs, Namespace resolves the saved client ID and tags,
issues a short-lived ID token from `https://federation.namespaceapis.com`, and joins Tailscale with:

```
tailscale up \
  --client-id="<tailscale-client-id>?preauthorized=true&ephemeral=true" \
  --id-token="$ID_TOKEN" \
  --advertise-tags=tag:namespace,tag:ci
```

This means:

- You keep long-lived Tailscale secrets out of Namespace
- Each workload authenticates with a short-lived Namespace-issued OIDC token
- Tailscale authorization stays scoped to the workspace and tags you configured above
- Devices are registered as ephemeral and auto-removed after going offline

### [​](/content/docs/integrations/tailscale\#use-with-github-actions/index.html)  Use with GitHub Actions

You can connect your CI runners to your Tailscale tailnet by adding the `tailscale.spec` feature
to your runner configuration. This lets your GitHub Actions workflows access private services
on your tailnet (e.g. databases, staging environments, internal APIs).

- With runner profiles

- With runner labels

Append the `tailscale.spec` feature to your profile name:

```
runs-on:
  - namespace-profile-my-profile;tailscale.spec=corp
```

Add the `tailscale.spec` feature to the `namespace-features` label:

```
runs-on:
  - nscloud-ubuntu-22.04-amd64-4x16-with-features
  - namespace-features:tailscale.spec=corp
```

The runner will automatically join your tailnet before the workflow job starts.
Replace `corp` with the name of the Tailscale spec you created with `nsc integrations tailscale set`.See [Connecting to Tailscale](/content/docs/solutions/github-actions/runner-controls/tailscale/index.html) for how
this feature fits alongside other runner settings.

### [​](/content/docs/integrations/tailscale\#use-with-devboxes/index.html)  Use with Devboxes

Devboxes support Tailscale out of the box. You can enable it in two ways:

- **Workspace defaults**: workspace admins can select a Tailscale spec on the [Devboxes defaults page](https://cloud.namespace.so/workspace/devboxes/defaults) so every new Devbox automatically joins your tailnet.
- **Per-devbox configuration**: add the integration to your Devbox YAML config:

```
integrations:
  tailscale:
    spec: corp
```

See the [spec file reference](/content/docs/reference/devbox-cli/spec-file/index.html) for the full configuration reference.

## [​](/content/docs/integrations/tailscale\#notes/index.html)  Notes

- Tailscale integration is currently supported for Linux workloads.
- The named integration only stores the client ID and tags; it does not store a Tailscale client secret.
- If Tailscale rejects the advertised tags, check that the same tags are allowed on the Tailscale trust credential.
- For more background on Namespace-issued OIDC tokens, see [Workload Federation with OpenID Connect](/content/docs/federation/openid/index.html).

Last modified onSeptember 22, 2026

Ctrl+I

{"docsConfig":{"theme":"almond","$schema":"https://mintlify.com/docs.json","name":"Namespace Documentation","colors":{"primary":"#1C32FF","light":"#6B78FF","dark":"#1C32FF"},"logo":{"light":"https://mintcdn.com/namespace-labs/qOJQ7kaWRgoS8lyv/logo-light.svg?fit=max\\u0026auto=format\\u0026n=qOJQ7kaWRgoS8lyv\\u0026q=85\\u0026s=6827b0c81c335badc1cef13b83383e1d","dark":"https://mintcdn.com/namespace-labs/qOJQ7kaWRgoS8lyv/logo-dark.svg?fit=max\\u0026auto=format\\u0026n=qOJQ7kaWRgoS8lyv\\u0026q=85\\u0026s=63702d83d8fb259023deb79db06aabbb","href":"https://namespace.so"},"favicon":"https://mintcdn.com/namespace-labs/MoefQ379UcpNU680/favicon.svg?fit=max\\u0026auto=format\\u0026n=MoefQ379UcpNU680\\u0026q=85\\u0026s=6f14a088da55e5f41847845796737353","navbar":{"links":\[{"href":"https://namespace.so/changelog","label":"Changelog"},{"href":"https://namespace.so/support","label":"Support"}\],"primary":{"type":"button","label":"Log in","href":"https://cloud.namespace.so"}},"footer":{"socials":{"github":"https://github.com/namespacelabs","linkedin":"https://www.linkedin.com/company/namespacelabs","x":"https://x.com/namespacelabs"}},"icons":{"library":"lucide"},"contextual":{"options":\["copy","view","chatgpt","claude"\],"display":"header"},"interaction":{"drilldown":false},"metadata":{"timestamp":true},"styling":{"latex":true},"navigation":{"global":{"anchors":\[{"anchor":"Changelog","icon":"history","href":"https://namespace.so/changelog"},{"anchor":"Trust Center (SOC2)","icon":"shield-check","href":"https://trust.namespace.so/"},{"anchor":"Status","icon":"activity","href":"https://namespace-status.com/"},{"anchor":"Support","icon":"message-circle","href":"https://namespace.so/support"}\]},"pages":\[\]}},"deployment":{"deploymentMetadataValue":{"subdomain":"namespace-labs","hasAudioNarration":false,"actualSubdomain":"namespace-labs","customDomains":\["namespace.so"\],"gitSource":{"type":"github","owner":"namespacelabs","repo":"docs","deployBranch":"main","contentDirectory":"","isPrivate":true,"mountPath":"","label":""},"chroma":{"latestBuiltDeploymentHistoryId":"6ae0862207896b4595e1934b","collectionId":"847aecca-4a0b-40b4-a393-e976cc214b43","liveDeploymentHistoryId":"6ae0862207896b4595e1934b","schemaVersion":"v3"},"entitlements":{"AI\_CHAT":{"status":"ENABLED"},"WEB\_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6ae0a8f6edbd4c098a94623c","clientVersion":"0.0.3971","searchFilterCounts":\[{"language":"default","tag":"Products","count":377},{"language":"default","tag":"CLI","count":166},{"language":"default","tag":"Command line","count":165},{"language":"default","tag":"Namespace CLI","count":131},{"language":"default","tag":"Documentation","count":104},{"language":"default","tag":"GitHub Actions","count":40},{"language":"default","tag":"Devbox CLI","count":34},{"language":"default","tag":"Integrations","count":33},{"language":"default","tag":"SDK","count":25},{"language":"default","tag":"Namespace SDK","count":23}\]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableContextualStarterQuestions":false,"enableAskAiSearchBar":true},"basePath":"/docs","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":\[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"editor-v7-file-tree","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"pause-universal-search-reconcile","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"per-site-search-delta","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"editor-private-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"editor-nav-generations","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"byok-sep-25","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"editor-agent-model-picker","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"billing-updated-9-15","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature\_enabled":true},"impressionData":false}\],"isAtlas":false,"googleFontsInlined":true},"customCss":\[{"filePath":"snippets/diagrams/styles.css","content":".ns-diagram{--ns-diagram-background:#ffffff;--ns-diagram-grid:#e5e7ee;--ns-diagram-border:#e5e7ee;--ns-diagram-card:#ffffff;--ns-diagram-neutral-zone:#fafbfc;--ns-diagram-brand-zone-start:rgba(28, 50, 255, 0.04);--ns-diagram-brand-zone-end:rgba(28, 50, 255, 0.07);--ns-diagram-brand-border:#c8ceff;--ns-diagram-heading:#202938;--ns-diagram-muted:#8892a6;--ns-diagram-copy:#4a5468;position:relative;width:100%;margin:2rem 0;padding:clamp(20px,3.5vw,32px);overflow:hidden;color:var(--ns-diagram-heading);background:var(--ns-diagram-background);border:1px solid var(--ns-diagram-border);border-radius:20px;box-shadow:0 1px 0 rgba(32,41,56,.04),0 1px 2px rgba(32,41,56,.06)}.dark .ns-diagram{--ns-diagram-background:#111827;--ns-diagram-grid:#374151;--ns-diagram-border:#374151;--ns-diagram-card:#1f2937;--ns-diagram-neutral-zone:#171f2d;--ns-diagram-brand-zone-start:rgba(107, 120, 255, 0.1);--ns-diagram-brand-zone-end:rgba(107, 120, 255, 0.16);--ns-diagram-brand-border:#4f5fc7;--ns-diagram-heading:#f3f4f6;--ns-diagram-muted:#aeb6c5;--ns-diagram-copy:#cbd5e1}.ns-diagram-grid-background{position:absolute;inset:0;pointer-events:none;background-image:radial-gradient(circle,var(--ns-diagram-grid) 1px,transparent 1px);background-size:16px 16px;opacity:.5;mask-image:linear-gradient(180deg,transparent 0,#000 10%,#000 90%,transparent 100%)}.ns-diagram-content{position:relative}.ns-diagram-caption{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}.ns-diagram-mark{display:inline-flex;flex-shrink:0;align-items:center;justify-content:center;margin:0;border-radius:8px}.ns-diagram-mark-anthropic{color:#d97757;background:#fcefe8}.ns-diagram-mark-devin{color:#4338ca;background:#eef0ff}.ns-diagram-mark-cursor{color:#111827;background:#eef0f3}.ns-diagram-mark-control{color:#1c32ff;background:#e0e7ff}.ns-diagram-mark-terminal{color:#fff;background:#202938}.ns-diagram-mark-worker{color:#4338ca;background:#eef1ff}.ns-diagram-zone{position:relative;display:flex;flex-direction:column;padding:1.25rem;background:var(--ns-diagram-neutral-zone);border:1px dashed #d2d6e0;border-radius:14px}.dark .ns-diagram-zone{border-color:#4b5563}.ns-diagram-zone-brand{background:linear-gradient(180deg,var(--ns-diagram-brand-zone-start),var(--ns-diagram-brand-zone-end));border:1px solid var(--ns-diagram-brand-border)}.ns-diagram-zone-header{display:flex;align-items:center;gap:.5rem;margin-bottom:.75rem;color:var(--ns-diagram-copy);font-size:11px;font-weight:600;letter-spacing:.1em;text-transform:uppercase}.ns-diagram-zone-center{display:flex;flex:1;align-items:center}.ns-diagram-zone-center>\*{width:100%}.ns-diagram-card{position:relative;display:flex;align-items:center;gap:1rem;min-width:0;padding:1rem 1.25rem;background:var(--ns-diagram-card);border:1px solid var(--ns-diagram-border);border-radius:12px;box-shadow:0 1px 0 rgba(32,41,56,.04),0 1px 2px rgba(32,41,56,.06)}.ns-diagram-card-brand{border-color:var(--ns-diagram-brand-border)}.ns-diagram-card-copy{display:flex;min-width:0;flex-direction:column}.ns-diagram-card-label{color:var(--ns-diagram-heading);font-size:16px;font-weight:600;line-height:1.25;letter-spacing:-.01em}.ns-diagram-card-sublabel{margin-top:.125rem;color:var(--ns-diagram-muted);font-size:12px;line-height:1.35}.ns-managed-layout{display:grid;grid-template-columns:1fr auto 1.05fr;align-items:stretch}.ns-managed-connector{display:flex;width:64px;flex-direction:column;align-items:center;justify-content:center;padding:0 .25rem;color:var(--ns-diagram-muted);font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;font-size:10.5px}.ns-managed-connector>span{margin-bottom:.375rem}.ns-managed-connector-path{display:flex;width:56px;align-items:center}.ns-managed-connector-line{flex:1;height:1.5px;background:#d2d6e0}.ns-managed-connector-arrow{border-top:6px solid transparent;border-bottom:6px solid transparent;border-left:9px solid #d2d6e0}.ns-mini-connector{display:flex;flex-direction:column;align-items:center;padding:.375rem 0}.ns-mini-connector>div{width:1.5px;height:12px;background:var(--ns-diagram-brand-border)}.ns-mini-connector>span{border-top:7px solid var(--ns-diagram-brand-border);border-right:5px solid transparent;border-left:5px solid transparent}.ns-devin-devboxes,.ns-devin-sessions{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:1.5rem}.ns-devin-mobile-layout{display:none}.ns-devin-connectors,.ns-devin-connectors>div{display:grid;grid-template-columns:repeat(2,minmax(0,1fr))}.ns-devin-connectors{gap:1.5rem}.ns-devin-connectors>div{padding:0 1rem}.ns-devin-connector{position:relative;display:flex;min-height:110px;align-items:center;justify-content:center;color:var(--ns-diagram-copy);font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;font-size:10px;line-height:1.25;text-align:center}.ns-devin-management-connector{min-height:70px;color:#6366f1}.ns-devin-connector-line{position:absolute;top:0;bottom:0;left:50%;width:1.5px;background:#d2d6e0;transform:translateX(-50%)}.ns-devin-management-connector .ns-devin-connector-line,.ns-diagram-connector-dashed .ns-diagram-vertical-line{width:0;background:0 0;border-left:1.5px dashed var(--ns-diagram-brand-border)}.ns-devin-connector>span,.ns-diagram-vertical-connector>span{position:relative;z-index:1;padding:0 .375rem;background:var(--ns-diagram-background)}.ns-control-plane-pill{display:flex;align-items:center;align-self:center;gap:.375rem;margin-bottom:1rem;padding:.375rem .75rem;color:#4338ca;background:#eef1ff;border:1px solid var(--ns-diagram-brand-border);border-radius:999px;font-size:12px;font-weight:500}.ns-diagram-vertical-connector{position:relative;display:flex;align-items:center;justify-content:center;color:var(--ns-diagram-copy);font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;font-size:10px;line-height:1.25;text-align:center}.ns-diagram-vertical-line{position:absolute;top:0;bottom:0;left:50%;width:1.5px;background:#d2d6e0;transform:translateX(-50%)}.ns-diagram-connector-dashed{color:#6366f1}.ns-diagram-arrow-down{position:absolute;bottom:0;left:50%;border-top:8px solid #d2d6e0;border-right:5px solid transparent;border-left:5px solid transparent;transform:translateX(-50%)}.ns-devin-management-connector .ns-diagram-arrow-down,.ns-diagram-connector-dashed .ns-diagram-arrow-down{border-top-color:var(--ns-diagram-brand-border)}.ns-bazel-connector-inset{padding:0 1rem}.ns-bazel-workers{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:1rem}@media (max-width:767px){.ns-managed-layout{grid-template-columns:1fr}.ns-managed-connector{position:relative;width:auto;min-height:64px;padding:.5rem 0}.ns-managed-connector-path{width:auto;flex-direction:column}.ns-managed-connector-line{width:1.5px;height:24px;flex:none}.ns-managed-connector-arrow{border-top:9px solid #d2d6e0;border-right:6px solid transparent;border-bottom:0;border-left:6px solid transparent}.ns-devin-connectors,.ns-devin-devboxes,.ns-devin-sessions{grid-template-columns:1fr}.ns-devin-desktop-layout{display:none}.ns-devin-mobile-layout{display:block}.ns-devin-mobile-lane+.ns-devin-mobile-lane{margin-top:1.5rem;padding-top:1.5rem;border-top:1px solid var(--ns-diagram-border)}.ns-devin-mobile-connectors{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));padding:0 .5rem}.ns-devin-connector{min-height:80px}.ns-bazel-workers{grid-template-columns:1fr}}"},{"filePath":"style.css","content":":root{--namespace-radius-inline:0.25rem;--namespace-radius-control:0.375rem;--namespace-radius-container:0.5rem}#content-container,.almond-layout>div,.card,.chat-assistant-floating-input>div,.code-block,.frame,.pagination-next,.pagination-prev{border-radius:var(--namespace-radius-container)}.code-block \[data-component-part=code-block-root\],.frame>div{border-radius:inherit}#assistant-entry,#chat-assistant-textarea,#search-bar-entry,#search-input,.callout,.frame>.relative{border-radius:var(--namespace-radius-control)}.code-block-fade-overlay{border-radius:0 var(--namespace-radius-container) var(--namespace-radius-container) 0}#page-context-menu>button:first-child{border-radius:var(--namespace-radius-control) 0 0 var(--namespace-radius-control)}#page-context-menu>button:last-child{border-radius:0 var(--namespace-radius-control) var(--namespace-radius-control) 0}#content :not(pre)>code,#navigation-items li>a,#navigation-items li>button{border-radius:var(--namespace-radius-inline)}#navigation-items .nav-anchor>:is(svg, img),#navigation-items .sidebar-group-icon,#navigation-items \[data-component-part=scroll-area-content\]:has(>ul.nav-anchors),#navigation-items li>:is(a, button)>div\[class~=\\"h-\[1lh\]\\"\]:first-child{display:flex;flex-direction:column}#navigation-items \[data-component-part=scroll-area-content\]>ul.nav-anchors{order:1;margin-top:1rem;padding-top:1rem;border-top:1px solid color-mix(in srgb,currentColor 10%,transparent)}#navigation-items \[data-component-part=scroll-area-content\]>ul.sidebar-group{margin-top:.5rem}#navigation-items \[data-component-part=scroll-area-content\]>ul.sidebar-group+div{margin-top:1rem}.tab-container{overflow:hidden;padding:0 1rem 1rem;border:1px solid color-mix(in srgb,currentColor 12%,transparent);border-radius:var(--namespace-radius-container)}.tab-container \[data-component-part=tab-content\]>\[data-table-wrapper\]:last-child{margin-bottom:0;padding-bottom:0}#content .katex-display>.katex{text-align:left}.compact-table table td{min-width:0}#navigation-items ul.sidebar-group>li.space-y-px+li.space-y-px{margin-top:.75rem}#navigation-items .my-2>.sidebar-group-header{margin-bottom:.625rem;font-size:.8125rem;line-height:1.625rem;font-weight:600;letter-spacing:-.02em;text-transform:none;opacity:1}#navigation-items ul.sidebar-group>li.space-y-px>button{font-size:.8125rem;font-weight:600;letter-spacing:-.02em;background-color:transparent}#navigation-items ul.sidebar-group>li.space-y-px>button:hover,#navigation-items ul.sidebar-group>li.space-y-px>ul>li.space-y-px>button:hover{background-color:color-mix(in srgb,currentColor 6%,transparent)}#navigation-items ul.sidebar-group>li.space-y-px>ul>li.space-y-px>button,#navigation-items ul.sidebar-group>li.space-y-px>ul>li>a{padding-left:3rem!important;font-size:.8125rem;font-weight:400;letter-spacing:-.02em}#navigation-items ul.sidebar-group>li.space-y-px>ul>li.space-y-px>ul>li\[data-active-nav-item=true\]>a,#navigation-items ul.sidebar-group>li.space-y-px>ul>li\[data-active-nav-item=true\]>a{color:#121516!important;background-color:rgb(18 21 22/6%)!important}.dark #navigation-items ul.sidebar-group>li.space-y-px>ul>li.space-y-px>ul>li\[data-active-nav-item=true\]>a,.dark #navigation-items ul.sidebar-group>li.space-y-px>ul>li\[data-active-nav-item=true\]>a{color:#f4f4f5!important;background-color:rgb(255 255 255/8%)!important}#navigation-items ul.sidebar-group>li.space-y-px>ul>li.space-y-px>button{background-color:transparent}#navigation-items ul.sidebar-group>li.space-y-px>ul>li.space-y-px>button>div\[class~=\\"h-\[1lh\]\\"\]:first-child{margin-left:-1.75rem}.dark #navigation-items img\[src\*=buildkite-mark\]{filter:brightness(.7)}.dark img\[src\*=\\"/icons/apple.svg\\"\]{filter:invert(1)}.dark img.tab-icon\[src\*=\\"/icons/linux.svg\\"\]{filter:invert(.35) brightness(1.54)}#navigation-items ul.sidebar-group>li.space-y-px>ul>li.space-y-px>ul>li>a{padding-left:4rem!important;font-size:.8125rem;font-weight:400;letter-spacing:-.02em}@media (min-width:1024px){#sidebar-content{width:calc(16.5rem + 10px)}#content-container{margin-left:calc(16.5rem + 10px)}#navbar{container-type:inline-size}#navbar .nav-tabs{position:fixed;top:0;left:20rem;height:3.5rem;column-gap:2rem}#navbar div:has(>div>.nav-tabs){justify-content:flex-end}@container (max-width: 69rem){#navbar .navbar-link:has(>a\[href=\\"https://namespace.so/changelog\\"\]){display:none}}}@media (min-width:1280px){#content-container{padding-right:1.5rem;padding-left:3rem}#content-container>div{column-gap:1.5rem;justify-content:flex-start}#content-area{width:calc(100% - 13.5rem);max-width:52rem;flex:none}#content-side-layout{width:15rem;max-width:15rem;flex-basis:15rem}#content-side-layout>div{width:15rem;padding-left:1rem}#content-side-layout>div>div{width:14rem}}@media (min-width:1700px){#content-container>div{justify-content:center}}"},{"filePath":"reference/github-actions/runner-configuration.css","content":""},{"filePath":"workspaces/access.css","content":""},{"filePath":"platform/workspaces/access.css","content":""},{"filePath":"reference/devbox-cli/desktop.css","content":""}\],"page":{"pagePath":"integrations/tailscale","slug":"/integrations/tailscale","pageMetadata":{"title":"Tailscale","description":null,"href":"/integrations/tailscale"},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\\"use strict\\";const{Fragment:\_Fragment,jsx:\_jsx,jsxs:\_jsxs}=arguments\[0\];const{useMDXComponents:\_provideComponents}=arguments\[0\];function \_createMdxContent(props){const \_components={a:\`a\`,code:\`code\`,li:\`li\`,p:\`p\`,pre:\`pre\`,span:\`span\`,strong:\`strong\`,ul:\`ul\`,...\_provideComponents(),...props.components},{CodeBlock,Frame,Heading,Info,OptimizedImage,Step,Steps,Tab,Tabs}=\_components;if(!CodeBlock)\_missingMdxReference(\`CodeBlock\`,true);if(!Frame)\_missingMdxReference(\`Frame\`,true);if(!Heading)\_missingMdxReference(\`Heading\`,true);if(!Info)\_missingMdxReference(\`Info\`,true);if(!OptimizedImage)\_missingMdxReference(\`OptimizedImage\`,true);if(!Step)\_missingMdxReference(\`Step\`,true);if(!Steps)\_missingMdxReference(\`Steps\`,true);if(!Tab)\_missingMdxReference(\`Tab\`,true);if(!Tabs)\_missingMdxReference(\`Tabs\`,true);return \_jsxs(\_Fragment,{children:\[\_jsx(\_components.p,{children:\`Connect Namespace workloads to your Tailscale tailnet with workload identity federation.\`}),\`\\n\`,\_jsx(Info,{children:\_jsx(\_components.p,{children:\`Tailscale integration is currently supported for Linux workloads only.\`})}),\`\\n\`,\_jsx(\_components.p,{children:\`Namespace relies on workload identity federation to connect your workloads to your Tailscale tailnet.\\nTo get started, you need a Tailscale OIDC client ID and the set of tags that Namespace workloads\\nshould advertise when they register.\`}),\`\\n\`,\_jsx(\_components.p,{children:\`At runtime, Namespace issues a short-lived OpenID Connect ID token and uses it to register the\\nworkload with your tailnet. No long-lived Tailscale auth key or client secret needs to be stored\\nin Namespace.\`}),\`\\n\`,\_jsx(Heading,{level:\`2\`,id:\`configure-tailscale\`,children:\`Configure Tailscale\`}),\`\\n\`,\_jsx(\_components.p,{children:\`Use the Tailscale admin console to create the client ID that Namespace will store.\`}),\`\\n\`,\_jsxs(Steps,{titleSize:\`h3\`,children:\[\_jsx(Step,{title:\`Create an OpenID Connect trust credential\`,id:\`create-an-openid-connect-trust-credential\`,children:\_jsxs(\_components.p,{children:\[\`Open Tailscale’s \`,\_jsx(\_components.a,{href:\`https://login.tailscale.com/admin/settings/trust-credentials\`,children:\`Trust credentials\`}),\` page,\\nselect \`,\_jsx(\_components.strong,{children:\`Credential\`}),\`, then choose \`,\_jsx(\_components.strong,{children:\`OpenID Connect\`}),\`.\`\]})}),\_jsxs(Step,{title:\`Configure Namespace as the issuer\`,id:\`configure-namespace-as-the-issuer\`,children:\[\_jsx(\_components.p,{children:\`Configure the credential to trust Namespace’s OIDC issuer:\`}),\_jsxs(\_components.ul,{children:\[\`\\n\`,\_jsxs(\_components.li,{children:\[\_jsx(\_components.strong,{children:\`Issuer\`}),\`: \`,\_jsx(\_components.code,{children:\`Custom issuer\`})\]}),\`\\n\`,\_jsxs(\_components.li,{children:\[\_jsx(\_components.strong,{children:\`Issuer URL\`}),\`: \`,\_jsx(\_components.code,{children:\`https://federation.namespaceapis.com\`})\]}),\`\\n\`,\_jsxs(\_components.li,{children:\[\_jsx(\_components.strong,{children:\`Subject\`}),\`: \`,\_jsx(\_components.code,{children:\`\\u003cworkspace-id>/\*\`})\]}),\`\\n\`\]}),\_jsxs(\_components.p,{children:\[\`The subject pattern above allows workloads from one Namespace workspace to join your tailnet.\\nNamespace issues ID tokens with subjects in the form \`,\_jsx(\_components.code,{children:\`\\u003cworkspace-id>/\\u003cinstance-id>\`}),\` for workloads.\`\]}),\_jsxs(\_components.p,{children:\[\`You can find your workspace ID in \`,\_jsx(\_components.a,{href:\`https://cloud.namespace.so/workspace/settings\`,children:\`Workspace settings\`}),\`.\`\]}),\_jsx(Frame,{style:{maxWidth:600,marginInline:\`auto\`},children:\_jsx(OptimizedImage,{src:\`https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-1.webp?fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=7b5353f92f735474c4033e66f01b72e6\`,alt:\`Tailscale OpenID Connect trust credential settings\`,width:1008,height:1484,\\"data-og-width\\":\`1008\`,\\"data-og-height\\":\`1484\`,\\"data-path\\":\`images/integrations/tailscale-credential-setup-1.webp\`,\\"data-optimize\\":\`true\`,\\"data-opv\\":\`3\`,srcset:\`https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-1.webp?w=280\\u0026fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=a63e229491fc5315bbcdca3bd19f04aa 280w, https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-1.webp?w=560\\u0026fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=dda41e5d507d644ac71823580d236d51 560w, https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-1.webp?w=840\\u0026fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=db66e063bfe0d56901797f7e224f2a2d 840w, https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-1.webp?w=1100\\u0026fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=396532258cad81ed824823f899fc1246 1100w, https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-1.webp?w=1650\\u0026fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=973c8c188481010e6d9bc50d7be699e6 1650w, https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-1.webp?w=2500\\u0026fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=c66976077323b849b08399160d9890a2 2500w\`})})\]}),\_jsxs(Step,{title:\`Grant node-registration access and tags\`,id:\`grant-node-registration-access-and-tags\`,children:\[\_jsx(\_components.p,{children:\`Grant the credential the ability to register nodes and select the tags that Namespace workloads are allowed to advertise.\\nThe tags you save in Namespace must be a subset of the tags allowed here.\`}),\_jsx(\_components.p,{children:\`For Namespace-managed node registration, enable the scope that allows auth key generation for node joins:\`}),\_jsxs(\_components.ul,{children:\[\`\\n\`,\_jsxs(\_components.li,{children:\[\_jsx(\_components.strong,{children:\`Scope\`}),\`: \`,\_jsx(\_components.code,{children:\`auth\_keys\`})\]}),\`\\n\`,\_jsxs(\_components.li,{children:\[\_jsx(\_components.strong,{children:\`Tags\`}),\`: every tag you plan to pass through \`,\_jsx(\_components.code,{children:\`nsc integrations tailscale set --tag ...\`})\]}),\`\\n\`\]}),\_jsxs(\_components.p,{children:\[\`After you generate the credential, Tailscale shows both a \`,\_jsx(\_components.strong,{children:\`Client ID\`}),\` and an \`,\_jsx(\_components.strong,{children:\`Audience\`}),\`.\\nNamespace only needs the \`,\_jsx(\_components.strong,{children:\`Client ID\`}),\`. It automatically requests an ID token with audience \`,\_jsx(\_components.code,{children:\`api.tailscale.com/\\u003cclient-id>\`}),\`.\`\]}),\_jsx(Frame,{style:{maxWidth:600,marginInline:\`auto\`},children:\_jsx(OptimizedImage,{src:\`https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-2.webp?fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=44621dc04c68d79833383a868bc25868\`,alt:\`Tailscale scopes and tags for Namespace workload identity\`,width:1306,height:846,\\"data-og-width\\":\`1306\`,\\"data-og-height\\":\`846\`,\\"data-path\\":\`images/integrations/tailscale-credential-setup-2.webp\`,\\"data-optimize\\":\`true\`,\\"data-opv\\":\`3\`,srcset:\`https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-2.webp?w=280\\u0026fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=17ac4bc29dabbb3f7733a04a17d0e20d 280w, https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-2.webp?w=560\\u0026fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=89afb6bfeff91d52436e4d21b5f1442a 560w, https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-2.webp?w=840\\u0026fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=bc0f3c158fa1e01fe637797fddeb0a28 840w, https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-2.webp?w=1100\\u0026fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=65239805795b9fbdce848609bf978477 1100w, https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-2.webp?w=1650\\u0026fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=2d4d9727fe4de8853eebf634e1e250e5 1650w, https://mintcdn.com/namespace-labs/QVtD1jw4ML2vd3TZ/images/integrations/tailscale-credential-setup-2.webp?w=2500\\u0026fit=max\\u0026auto=format\\u0026n=QVtD1jw4ML2vd3TZ\\u0026q=85\\u0026s=40e1fbd412b88df6d23fccc2d9a41a0d 2500w\`})})\]})\]}),\`\\n\`,\_jsx(Heading,{level:\`2\`,id:\`configure-the-integration-in-namespace\`,children:\`Configure the integration in Namespace\`}),\`\\n\`,\_jsx(\_components.p,{children:\`Once you have the Tailscale client ID, store it in your Namespace workspace with a friendly name.\`}),\`\\n\`,\_jsxs(\_components.p,{children:\[\`You can do this from the \`,\_jsx(\_components.a,{href:\`https://cloud.namespace.so/workspace/integrations\`,children:\`Integrations page\`}),\` in the Namespace console, or with the CLI:\`\]}),\`\\n\`,\_jsx(CodeBlock,{filename:\`\`,numberOfLines:\`1\`,language:\`shellscript\`,children:\_jsx(\_components.pre,{className:\`shiki shiki-themes github-light-default dark-plus\`,style:{backgroundColor:\`#ffffff\`,\\"--shiki-dark-bg\\":\`#0B0C0E\`,color:\`#1f2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},language:\`shellscript\`,children:\_jsxs(\_components.code,{language:\`shellscript\`,numberOfLines:\`1\`,children:\[\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#953800\`,\\"--shiki-dark\\":\`#DCDCAA\`},children:\`nsc\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` integrations\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` tailscale\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` set\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` corp\`}),\_jsx(\_components.span,{style:{color:\`#0550AE\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` --oauth-client-id\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\` \\u003c\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`tailscale-client-i\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`d\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\`>\`}),\_jsx(\_components.span,{style:{color:\`#0550AE\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` --tag\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` tag:namespace\`}),\_jsx(\_components.span,{style:{color:\`#0550AE\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` --tag\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` tag:ci\`})\]}),\`\\n\`\]})})}),\`\\n\`,\_jsxs(\_components.p,{children:\[\`This command creates or replaces the named spec \`,\_jsx(\_components.code,{children:\`corp\`}),\`.\\nThe stored tags are the tags Namespace passes to \`,\_jsx(\_components.code,{children:\`tailscale up --advertise-tags=...\`}),\` when the workload joins your tailnet.\`\]}),\`\\n\`,\_jsx(\_components.p,{children:\`You can pass tags either multiple times or as a comma-separated list:\`}),\`\\n\`,\_jsx(CodeBlock,{filename:\`\`,numberOfLines:\`3\`,language:\`shellscript\`,children:\_jsx(\_components.pre,{className:\`shiki shiki-themes github-light-default dark-plus\`,style:{backgroundColor:\`#ffffff\`,\\"--shiki-dark-bg\\":\`#0B0C0E\`,color:\`#1f2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},language:\`shellscript\`,children:\_jsxs(\_components.code,{language:\`shellscript\`,numberOfLines:\`3\`,children:\[\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#953800\`,\\"--shiki-dark\\":\`#DCDCAA\`},children:\`nsc\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` integrations\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` tailscale\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` set\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` corp\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D7BA7D\`},children:\` \\\\\\\`})\]}),\`\\n\`,\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#0550AE\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` --oauth-client-id\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\` \\u003c\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`tailscale-client-i\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`d\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\`>\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D7BA7D\`},children:\` \\\\\\\`})\]}),\`\\n\`,\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#0550AE\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` --tag\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` tag:namespace,tag:ci\`})\]}),\`\\n\`\]})})}),\`\\n\`,\_jsx(Heading,{level:\`3\`,id:\`magic-dns\`,children:\`Magic DNS\`}),\`\\n\`,\_jsxs(\_components.p,{children:\[\`You can enable \`,\_jsx(\_components.a,{href:\`https://tailscale.com/kb/1081/magicdns\`,children:\`Tailscale Magic DNS\`}),\` so that workloads\\ncan reach other devices on your tailnet by their machine name. To enable it, pass the \`,\_jsx(\_components.code,{children:\`--enable-magic-dns\`}),\` flag:\`\]}),\`\\n\`,\_jsx(CodeBlock,{filename:\`\`,numberOfLines:\`4\`,language:\`shellscript\`,children:\_jsx(\_components.pre,{className:\`shiki shiki-themes github-light-default dark-plus\`,style:{backgroundColor:\`#ffffff\`,\\"--shiki-dark-bg\\":\`#0B0C0E\`,color:\`#1f2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},language:\`shellscript\`,children:\_jsxs(\_components.code,{language:\`shellscript\`,numberOfLines:\`4\`,children:\[\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#953800\`,\\"--shiki-dark\\":\`#DCDCAA\`},children:\`nsc\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` integrations\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` tailscale\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` set\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` corp\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D7BA7D\`},children:\` \\\\\\\`})\]}),\`\\n\`,\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#0550AE\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` --oauth-client-id\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\` \\u003c\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`tailscale-client-i\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`d\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\`>\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D7BA7D\`},children:\` \\\\\\\`})\]}),\`\\n\`,\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#0550AE\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` --tag\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` tag:namespace\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D7BA7D\`},children:\` \\\\\\\`})\]}),\`\\n\`,\_jsx(\_components.span,{className:\`line\`,children:\_jsx(\_components.span,{style:{color:\`#0550AE\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` --enable-magic-dns\`})}),\`\\n\`\]})})}),\`\\n\`,\_jsxs(\_components.p,{children:\[\`You can also toggle Magic DNS directly from the \`,\_jsx(\_components.a,{href:\`https://cloud.namespace.so/workspace/integrations\`,children:\`Integrations page\`}),\`.\\nTo test that Magic DNS is working correctly you can perform a DNS lookup:\`\]}),\`\\n\`,\_jsx(CodeBlock,{filename:\`\`,numberOfLines:\`1\`,language:\`shellscript\`,children:\_jsx(\_components.pre,{className:\`shiki shiki-themes github-light-default dark-plus\`,style:{backgroundColor:\`#ffffff\`,\\"--shiki-dark-bg\\":\`#0B0C0E\`,color:\`#1f2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},language:\`shellscript\`,children:\_jsxs(\_components.code,{language:\`shellscript\`,numberOfLines:\`1\`,children:\[\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#953800\`,\\"--shiki-dark\\":\`#DCDCAA\`},children:\`dig\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` +search\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` +short\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\` \\u003c\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`device-nam\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`e\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\`>\`})\]}),\`\\n\`\]})})}),\`\\n\`,\_jsx(Heading,{level:\`2\`,id:\`inspect-and-remove-specs\`,children:\`Inspect And Remove Specs\`}),\`\\n\`,\_jsx(\_components.p,{children:\`List the currently configured Tailscale specs in your workspace:\`}),\`\\n\`,\_jsx(CodeBlock,{filename:\`\`,numberOfLines:\`1\`,language:\`shellscript\`,children:\_jsx(\_components.pre,{className:\`shiki shiki-themes github-light-default dark-plus\`,style:{backgroundColor:\`#ffffff\`,\\"--shiki-dark-bg\\":\`#0B0C0E\`,color:\`#1f2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},language:\`shellscript\`,children:\_jsxs(\_components.code,{language:\`shellscript\`,numberOfLines:\`1\`,children:\[\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#953800\`,\\"--shiki-dark\\":\`#DCDCAA\`},children:\`nsc\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` integrations\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` tailscale\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` list\`})\]}),\`\\n\`\]})})}),\`\\n\`,\_jsx(\_components.p,{children:\`To inspect the full machine-readable response instead, use JSON output:\`}),\`\\n\`,\_jsx(CodeBlock,{filename:\`\`,numberOfLines:\`1\`,language:\`shellscript\`,children:\_jsx(\_components.pre,{className:\`shiki shiki-themes github-light-default dark-plus\`,style:{backgroundColor:\`#ffffff\`,\\"--shiki-dark-bg\\":\`#0B0C0E\`,color:\`#1f2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},language:\`shellscript\`,children:\_jsxs(\_components.code,{language:\`shellscript\`,numberOfLines:\`1\`,children:\[\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#953800\`,\\"--shiki-dark\\":\`#DCDCAA\`},children:\`nsc\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` integrations\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` tailscale\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` list\`}),\_jsx(\_components.span,{style:{color:\`#0550AE\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` --output\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` json\`})\]}),\`\\n\`\]})})}),\`\\n\`,\_jsx(\_components.p,{children:\`Remove a named spec when you no longer need it:\`}),\`\\n\`,\_jsx(CodeBlock,{filename:\`\`,numberOfLines:\`1\`,language:\`shellscript\`,children:\_jsx(\_components.pre,{className:\`shiki shiki-themes github-light-default dark-plus\`,style:{backgroundColor:\`#ffffff\`,\\"--shiki-dark-bg\\":\`#0B0C0E\`,color:\`#1f2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},language:\`shellscript\`,children:\_jsxs(\_components.code,{language:\`shellscript\`,numberOfLines:\`1\`,children:\[\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#953800\`,\\"--shiki-dark\\":\`#DCDCAA\`},children:\`nsc\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` integrations\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` tailscale\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` remove\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` corp\`})\]}),\`\\n\`\]})})}),\`\\n\`,\_jsx(Heading,{level:\`2\`,id:\`how-namespace-uses-the-spec\`,children:\`How Namespace Uses The Spec\`}),\`\\n\`,\_jsxs(\_components.p,{children:\[\`When a Namespace workload uses one of these named specs, Namespace resolves the saved client ID and tags,\\nissues a short-lived ID token from \`,\_jsx(\_components.code,{children:\`https://federation.namespaceapis.com\`}),\`, and joins Tailscale with:\`\]}),\`\\n\`,\_jsx(CodeBlock,{filename:\`\`,numberOfLines:\`4\`,language:\`shellscript\`,children:\_jsx(\_components.pre,{className:\`shiki shiki-themes github-light-default dark-plus\`,style:{backgroundColor:\`#ffffff\`,\\"--shiki-dark-bg\\":\`#0B0C0E\`,color:\`#1f2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},language:\`shellscript\`,children:\_jsxs(\_components.code,{language:\`shellscript\`,numberOfLines:\`4\`,children:\[\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#953800\`,\\"--shiki-dark\\":\`#DCDCAA\`},children:\`tailscale\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\` up\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D7BA7D\`},children:\` \\\\\\\`})\]}),\`\\n\`,\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#0550AE\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` --client-id=\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`\\"\\u003ctailscale-client-id>?preauthorized=true\\u0026ephemeral=true\\"\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D7BA7D\`},children:\` \\\\\\\`})\]}),\`\\n\`,\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#0550AE\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` --id-token=\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`\\"\`}),\_jsx(\_components.span,{style:{color:\`#1F2328\`,\\"--shiki-dark\\":\`#9CDCFE\`},children:\`$ID\_TOKEN\`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`\\"\`}),\_jsx(\_components.span,{style:{color:\`#CF222E\`,\\"--shiki-dark\\":\`#D7BA7D\`},children:\` \\\\\\\`})\]}),\`\\n\`,\_jsx(\_components.span,{className:\`line\`,children:\_jsx(\_components.span,{style:{color:\`#0550AE\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` --advertise-tags=tag:namespace,tag:ci\`})}),\`\\n\`\]})})}),\`\\n\`,\_jsx(\_components.p,{children:\`This means:\`}),\`\\n\`,\_jsxs(\_components.ul,{children:\[\`\\n\`,\_jsx(\_components.li,{children:\`You keep long-lived Tailscale secrets out of Namespace\`}),\`\\n\`,\_jsx(\_components.li,{children:\`Each workload authenticates with a short-lived Namespace-issued OIDC token\`}),\`\\n\`,\_jsx(\_components.li,{children:\`Tailscale authorization stays scoped to the workspace and tags you configured above\`}),\`\\n\`,\_jsx(\_components.li,{children:\`Devices are registered as ephemeral and auto-removed after going offline\`}),\`\\n\`\]}),\`\\n\`,\_jsx(Heading,{level:\`3\`,id:\`use-with-github-actions\`,children:\`Use with GitHub Actions\`}),\`\\n\`,\_jsxs(\_components.p,{children:\[\`You can connect your CI runners to your Tailscale tailnet by adding the \`,\_jsx(\_components.code,{children:\`tailscale.spec\`}),\` feature\\nto your runner configuration. This lets your GitHub Actions workflows access private services\\non your tailnet (e.g. databases, staging environments, internal APIs).\`\]}),\`\\n\`,\_jsxs(Tabs,{children:\[\_jsxs(Tab,{title:\`With runner profiles\`,id:\`with-runner-profiles\`,children:\[\_jsxs(\_components.p,{children:\[\`Append the \`,\_jsx(\_components.code,{children:\`tailscale.spec\`}),\` feature to your profile name:\`\]}),\_jsx(CodeBlock,{filename:\`\`,highlight:\`\[2\]\`,numberOfLines:\`2\`,language:\`yaml\`,children:\_jsx(\_components.pre,{className:\`shiki shiki-themes github-light-default dark-plus\`,style:{backgroundColor:\`#ffffff\`,\\"--shiki-dark-bg\\":\`#0B0C0E\`,color:\`#1f2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},language:\`yaml\`,children:\_jsxs(\_components.code,{language:\`yaml\`,numberOfLines:\`2\`,children:\[\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#116329\`,\\"--shiki-dark\\":\`#569CD6\`},children:\`runs-on\`}),\_jsx(\_components.span,{style:{color:\`#1F2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\`:\`})\]}),\`\\n\`,\_jsxs(\_components.span,{className:\`line line-highlight\`,children:\[\_jsx(\_components.span,{style:{color:\`#1F2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\` - \`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`namespace-profile-my-profile;tailscale.spec=corp\`})\]}),\`\\n\`\]})})})\]}),\_jsxs(Tab,{title:\`With runner labels\`,id:\`with-runner-labels\`,children:\[\_jsxs(\_components.p,{children:\[\`Add the \`,\_jsx(\_components.code,{children:\`tailscale.spec\`}),\` feature to the \`,\_jsx(\_components.code,{children:\`namespace-features\`}),\` label:\`\]}),\_jsx(CodeBlock,{filename:\`\`,highlight:\`\[3\]\`,numberOfLines:\`3\`,language:\`yaml\`,children:\_jsx(\_components.pre,{className:\`shiki shiki-themes github-light-default dark-plus\`,style:{backgroundColor:\`#ffffff\`,\\"--shiki-dark-bg\\":\`#0B0C0E\`,color:\`#1f2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},language:\`yaml\`,children:\_jsxs(\_components.code,{language:\`yaml\`,numberOfLines:\`3\`,children:\[\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#116329\`,\\"--shiki-dark\\":\`#569CD6\`},children:\`runs-on\`}),\_jsx(\_components.span,{style:{color:\`#1F2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\`:\`})\]}),\`\\n\`,\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#1F2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\` - \`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`nscloud-ubuntu-22.04-amd64-4x16-with-features\`})\]}),\`\\n\`,\_jsxs(\_components.span,{className:\`line line-highlight\`,children:\[\_jsx(\_components.span,{style:{color:\`#1F2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\` - \`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`namespace-features:tailscale.spec=corp\`})\]}),\`\\n\`\]})})})\]})\]}),\`\\n\`,\_jsxs(\_components.p,{children:\[\`The runner will automatically join your tailnet before the workflow job starts.\\nReplace \`,\_jsx(\_components.code,{children:\`corp\`}),\` with the name of the Tailscale spec you created with \`,\_jsx(\_components.code,{children:\`nsc integrations tailscale set\`}),\`.\`\]}),\`\\n\`,\_jsxs(\_components.p,{children:\[\`See \`,\_jsx(\_components.a,{href:\`/solutions/github-actions/runner-controls/tailscale\`,children:\`Connecting to Tailscale\`}),\` for how\\nthis feature fits alongside other runner settings.\`\]}),\`\\n\`,\_jsx(Heading,{level:\`3\`,id:\`use-with-devboxes\`,children:\`Use with Devboxes\`}),\`\\n\`,\_jsx(\_components.p,{children:\`Devboxes support Tailscale out of the box. You can enable it in two ways:\`}),\`\\n\`,\_jsxs(\_components.ul,{children:\[\`\\n\`,\_jsxs(\_components.li,{children:\[\_jsx(\_components.strong,{children:\`Workspace defaults\`}),\`: workspace admins can select a Tailscale spec on the \`,\_jsx(\_components.a,{href:\`https://cloud.namespace.so/workspace/devboxes/defaults\`,children:\`Devboxes defaults page\`}),\` so every new Devbox automatically joins your tailnet.\`\]}),\`\\n\`,\_jsxs(\_components.li,{children:\[\_jsx(\_components.strong,{children:\`Per-devbox configuration\`}),\`: add the integration to your Devbox YAML config:\`\]}),\`\\n\`\]}),\`\\n\`,\_jsx(CodeBlock,{filename:\`\`,numberOfLines:\`3\`,language:\`yaml\`,children:\_jsx(\_components.pre,{className:\`shiki shiki-themes github-light-default dark-plus\`,style:{backgroundColor:\`#ffffff\`,\\"--shiki-dark-bg\\":\`#0B0C0E\`,color:\`#1f2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},language:\`yaml\`,children:\_jsxs(\_components.code,{language:\`yaml\`,numberOfLines:\`3\`,children:\[\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#116329\`,\\"--shiki-dark\\":\`#569CD6\`},children:\`integrations\`}),\_jsx(\_components.span,{style:{color:\`#1F2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\`:\`})\]}),\`\\n\`,\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#116329\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` tailscale\`}),\_jsx(\_components.span,{style:{color:\`#1F2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\`:\`})\]}),\`\\n\`,\_jsxs(\_components.span,{className:\`line\`,children:\[\_jsx(\_components.span,{style:{color:\`#116329\`,\\"--shiki-dark\\":\`#569CD6\`},children:\` spec\`}),\_jsx(\_components.span,{style:{color:\`#1F2328\`,\\"--shiki-dark\\":\`#D4D4D4\`},children:\`: \`}),\_jsx(\_components.span,{style:{color:\`#0A3069\`,\\"--shiki-dark\\":\`#CE9178\`},children:\`corp\`})\]}),\`\\n\`\]})})}),\`\\n\`,\_jsxs(\_components.p,{children:\[\`See the \`,\_jsx(\_components.a,{href:\`/reference/devbox-cli/spec-file\`,children:\`spec file reference\`}),\` for the full configuration reference.\`\]}),\`\\n\`,\_jsx(Heading,{level:\`2\`,id:\`notes\`,children:\`Notes\`}),\`\\n\`,\_jsxs(\_components.ul,{children:\[\`\\n\`,\_jsx(\_components.li,{children:\`Tailscale integration is currently supported for Linux workloads.\`}),\`\\n\`,\_jsx(\_components.li,{children:\`The named integration only stores the client ID and tags; it does not store a Tailscale client secret.\`}),\`\\n\`,\_jsx(\_components.li,{children:\`If Tailscale rejects the advertised tags, check that the same tags are allowed on the Tailscale trust credential.\`}),\`\\n\`,\_jsxs(\_components.li,{children:\[\`For more background on Namespace-issued OIDC tokens, see \`,\_jsx(\_components.a,{href:\`/federation/openid\`,children:\`Workload Federation with OpenID Connect\`}),\`.\`\]}),\`\\n\`\]})\]})}function MDXContent(props={}){const{wrapper:MDXLayout}={...\_provideComponents(),...props.components};return MDXLayout?\_jsx(MDXLayout,{...props,children:\_jsx(\_createMdxContent,{...props})}):\_createMdxContent(props)}return{default:MDXContent};function \_missingMdxReference(id,component){throw new Error(\`Expected \`+(component?\`component\`:\`object\`)+\\" \`\\"+id+\\"\` to be defined: you likely forgot to import, pass, or provide it.\\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Tailscale","description":null,"href":"/integrations/tailscale"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":\[{"title":"Configure Tailscale","slug":"configure-tailscale","depth":2,"children":\[{"title":"Create an OpenID Connect trust credential","slug":"create-an-openid-connect-trust-credential","depth":3,"children":\[\]},{"title":"Configure Namespace as the issuer","slug":"configure-namespace-as-the-issuer","depth":3,"children":\[\]},{"title":"Grant node-registration access and tags","slug":"grant-node-registration-access-and-tags","depth":3,"children":\[\]}\]},{"title":"Configure the integration in Namespace","slug":"configure-the-integration-in-namespace","depth":2,"children":\[{"title":"Magic DNS","slug":"magic-dns","depth":3,"children":\[\]}\]},{"title":"Inspect And Remove Specs","slug":"inspect-and-remove-specs","depth":2,"children":\[\]},{"title":"How Namespace Uses The Spec","slug":"how-namespace-uses-the-spec","depth":2,"children":\[{"title":"Use with GitHub Actions","slug":"use-with-github-actions","depth":3,"children":\[\]},{"title":"Use with Devboxes","slug":"use-with-devboxes","depth":3,"children":\[\]}\]},{"title":"Notes","slug":"notes","depth":2,"children":\[\]}\],"codeExamples":{}},"jsLinks":\["/docs/\_mintlify/custom/namespace-labs/fa018fe02fd436c8/navigation.js","/docs/\_mintlify/custom/namespace-labs/4276600b7cb636ff/legacy-anchor-redirects.js"\],"subdomain":"namespace-labs","siteName":"Namespace Documentation","title":"Tailscale - Namespace Documentation","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-10-26T10:46:18.073Z","gitLastModified":"2026-09-22T09:40:17.000Z","originalFileLocation":"integrations/tailscale.mdx"},"headHtml":"\\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\\"isDarkMode\\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\\u0026\\u0026p!=='dark'\\u0026\\u0026p!=='system')p=\\"system\\"}var r=p==='system'?(matchMedia(\\"(prefers-color-scheme: dark)\\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\\"data-theme-preference\\",p)})();\\u003c/script>\\u003cmeta data-mint-head name=\\"application-name\\" content=\\"Namespace Documentation\\">\\u003cmeta data-mint-head name=\\"generator\\" content=\\"Mintlify\\">\\u003clink data-mint-head rel=\\"icon\\" type=\\"image/png\\" sizes=\\"192x192\\" href=\\"/docs/mintlify-assets/\_mintlify/favicons/namespace-labs/kZKeJ4zhJEuE6\_kI/\_generated/favicon/android-chrome-192x192.png\\" media=\\"(prefers-color-scheme: light)\\">\\u003clink data-mint-head rel=\\"apple-touch-icon\\" type=\\"image/png\\" sizes=\\"180x180\\" href=\\"/docs/mintlify-assets/\_mintlify/favicons/namespace-labs/kZKeJ4zhJEuE6\_kI/\_generated/favicon/apple-touch-icon.png\\">\\u003clink data-mint-head rel=\\"icon\\" type=\\"image/png\\" sizes=\\"16x16\\" href=\\"/docs/mintlify-assets/\_mintlify/favicons/namespace-labs/kZKeJ4zhJEuE6\_kI/\_generated/favicon/favicon-16x16.png\\" media=\\"(prefers-color-scheme: light)\\">\\u003clink data-mint-head rel=\\"icon\\" type=\\"image/png\\" sizes=\\"32x32\\" href=\\"/docs/mintlify-assets/\_mintlify/favicons/namespace-labs/kZKeJ4zhJEuE6\_kI/\_generated/favicon/favicon-32x32.png\\" media=\\"(prefers-color-scheme: light)\\">\\u003clink data-mint-head rel=\\"shortcut icon\\" type=\\"image/x-icon\\" href=\\"/docs/mintlify-assets/\_mintlify/favicons/namespace-labs/kZKeJ4zhJEuE6\_kI/\_generated/favicon/favicon.ico\\" media=\\"(prefers-color-scheme: light)\\">\\u003clink data-mint-head rel=\\"icon\\" type=\\"image/png\\" sizes=\\"192x192\\" href=\\"/docs/mintlify-assets/\_mintlify/favicons/namespace-labs/kZKeJ4zhJEuE6\_kI/\_generated/favicon-dark/android-chrome-192x192.png\\" media=\\"(prefers-color-scheme: dark)\\">\\u003clink data-mint-head rel=\\"icon\\" type=\\"image/png\\" sizes=\\"16x16\\" href=\\"/docs/mintlify-assets/\_mintlify/favicons/namespace-labs/kZKeJ4zhJEuE6\_kI/\_generated/favicon-dark/favicon-16x16.png\\" media=\\"(prefers-color-scheme: dark)\\">\\u003clink data-mint-head rel=\\"icon\\" type=\\"image/png\\" sizes=\\"32x32\\" href=\\"/docs/mintlify-assets/\_mintlify/favicons/namespace-labs/kZKeJ4zhJEuE6\_kI/\_generated/favicon-dark/favicon-32x32.png\\" media=\\"(prefers-color-scheme: dark)\\">\\u003clink data-mint-head rel=\\"shortcut icon\\" type=\\"image/x-icon\\" href=\\"/docs/mintlify-assets/\_mintlify/favicons/namespace-labs/kZKeJ4zhJEuE6\_kI/\_generated/favicon-dark/favicon.ico\\" media=\\"(prefers-color-scheme: dark)\\">\\u003cmeta data-mint-head property=\\"og:title\\" content=\\"Tailscale - Namespace Documentation\\">\\u003cmeta data-mint-head property=\\"og:site\_name\\" content=\\"Namespace Documentation\\">\\u003cmeta data-mint-head property=\\"og:url\\" content=\\"https://namespace.so/docs/integrations/tailscale\\">\\u003cmeta data-mint-head property=\\"og:type\\" content=\\"website\\">\\u003cmeta data-mint-head property=\\"og:image\\" content=\\"https://namespace-labs.mintlify.app/\_mintlify/api/og/v2?division=Integrations\\u0026amp;title=Tailscale\\u0026amp;theme=1f89d53762a6d5304d1c63c4\\u0026amp;signature=658617e6aeffa44203786b2f06ec10ab7cd9f2cefd94f93d69194aeae7dc2867\\">\\u003cmeta data-mint-head property=\\"og:image:width\\" content=\\"1200\\">\\u003cmeta data-mint-head property=\\"og:image:height\\" content=\\"630\\">\\u003cmeta data-mint-head name=\\"twitter:card\\" content=\\"summary\_large\_image\\">\\u003cmeta data-mint-head name=\\"twitter:title\\" content=\\"Tailscale - Namespace Documentation\\">\\u003cmeta data-mint-head name=\\"twitter:image\\" content=\\"https://namespace-labs.mintlify.app/\_mintlify/api/og/v2?division=Integrations\\u0026amp;title=Tailscale\\u0026amp;theme=1f89d53762a6d5304d1c63c4\\u0026amp;signature=658617e6aeffa44203786b2f06ec10ab7cd9f2cefd94f93d69194aeae7dc2867\\">\\u003cmeta data-mint-head name=\\"twitter:image:width\\" content=\\"1200\\">\\u003cmeta data-mint-head name=\\"twitter:image:height\\" content=\\"630\\">\\u003cmeta data-mint-head name=\\"msapplication-config\\" content=\\"/docs/mintlify-assets/\_mintlify/favicons/namespace-labs/kZKeJ4zhJEuE6\_kI/\_generated/favicon/browserconfig.xml\\">\\u003cmeta data-mint-head name=\\"apple-mobile-web-app-title\\" content=\\"Namespace Documentation\\">\\u003cmeta data-mint-head name=\\"msapplication-TileColor\\" content=\\"#1C32FF\\">\\u003clink data-mint-head rel=\\"canonical\\" href=\\"https://namespace.so/docs/integrations/tailscale\\">\\u003clink data-mint-head rel=\\"alternate\\" type=\\"application/xml\\" href=\\"/docs/sitemap.xml\\">\\u003clink data-mint-head rel=\\"alternate\\" type=\\"text/markdown\\" href=\\"/docs/integrations/tailscale.md\\">\\u003cscript data-mint-head type=\\"application/ld+json\\">{\\"@context\\":\\"https://schema.org\\",\\"@graph\\":\[{\\"@type\\":\\"Organization\\",\\"@id\\":\\"https://namespace.so/#organization\\",\\"name\\":\\"Namespace Documentation\\",\\"url\\":\\"https://namespace.so\\",\\"logo\\":{\\"@type\\":\\"ImageObject\\",\\"url\\":\\"https://mintcdn.com/namespace-labs/qOJQ7kaWRgoS8lyv/logo-light.svg?fit=max\\u0026auto=format\\u0026n=qOJQ7kaWRgoS8lyv\\u0026q=85\\u0026s=6827b0c81c335badc1cef13b83383e1d\\"}},{\\"@type\\":\\"WebSite\\",\\"@id\\":\\"https://namespace.so/docs#website\\",\\"name\\":\\"Namespace Documentation\\",\\"url\\":\\"https://namespace.so/docs\\",\\"publisher\\":{\\"@id\\":\\"https://namespace.so/#organization\\"}},{\\"@type\\":\\"WebPage\\",\\"@id\\":\\"https://namespace.so/docs/integrations/tailscale#webpage\\",\\"url\\":\\"https://namespace.so/docs/integrations/tailscale\\",\\"name\\":\\"Tailscale\\",\\"dateModified\\":\\"2026-09-22T09:40:17.000Z\\",\\"isPartOf\\":{\\"@id\\":\\"https://namespace.so/docs#website\\"},\\"breadcrumb\\":{\\"@id\\":\\"https://namespace.so/docs/integrations/tailscale#breadcrumb\\"}},{\\"@type\\":\\"BreadcrumbList\\",\\"@id\\":\\"https://namespace.so/docs/integrations/tailscale#breadcrumb\\",\\"itemListElement\\":\[{\\"@type\\":\\"ListItem\\",\\"position\\":1,\\"name\\":\\"Integrations\\",\\"item\\":\\"https://namespace.so/docs/integrations/turborepo\\"},{\\"@type\\":\\"ListItem\\",\\"position\\":2,\\"name\\":\\"Tailscale\\",\\"item\\":\\"https://namespace.so/docs/integrations/tailscale\\"}\]},{\\"@type\\":\[\\"Article\\",\\"TechArticle\\"\],\\"@id\\":\\"https://namespace.so/docs/integrations/tailscale#article\\",\\"headline\\":\\"Tailscale\\",\\"name\\":\\"Tailscale\\",\\"url\\":\\"https://namespace.so/docs/integrations/tailscale\\",\\"mainEntityOfPage\\":{\\"@id\\":\\"https://namespace.so/docs/integrations/tailscale#webpage\\"},\\"dateModified\\":\\"2026-09-22T09:40:17.000Z\\",\\"publisher\\":{\\"@id\\":\\"https://namespace.so/#organization\\"},\\"isPartOf\\":{\\"@id\\":\\"https://namespace.so/docs#website\\"}}\]}\\u003c/script>\\u003cscript data-mint-head type=\\"application/ld+json\\">{\\"@context\\":\\"https://schema.org\\",\\"@type\\":\\"WebSite\\",\\"name\\":\\"Namespace Documentation\\",\\"creator\\":{\\"@type\\":\\"Organization\\",\\"name\\":\\"Mintlify\\",\\"url\\":\\"https://mintlify.com\\"}}\\u003c/script>","siteName":"Namespace Documentation","nav":{"global":{"anchors":\[{"anchor":"Changelog","icon":"history","href":"https://namespace.so/changelog"},{"anchor":"Trust Center (SOC2)","icon":"shield-check","href":"https://trust.namespace.so/"},{"anchor":"Status","icon":"activity","href":"https://namespace-status.com/"},{"anchor":"Support","icon":"message-circle","href":"https://namespace.so/support"}\]},"products":\[{"product":"Products","description":"Turnkey products built on the Namespace platform","tabs":\[{"tab":"Documentation","icon":"book-open","pages":\[{"title":"Documentation","href":""}\]},{"tab":"Integrations","icon":"blocks","pages":\[{"group":"Integrations","icon":"blocks","pages":\[{"title":"Turborepo caching","sidebarTitle":"Turborepo","href":"/integrations/turborepo"},{"title":"Playwright","href":"/integrations/playwright"},{"title":"Android Emulators","href":"/integrations/android-emulators"},{"title":"Gradle integration","sidebarTitle":"Gradle","href":"/integrations/gradle"},{"title":"sccache integration","sidebarTitle":"sccache","href":"/integrations/sccache"},{"title":"Optimizing Docker Build Performance in Circle CI","sidebarTitle":"CircleCI","href":"/solutions/circle-ci/docker-builds"},{"title":"Pants integration","sidebarTitle":"Pants","href":"/integrations/pants"},{"title":"Moonrepo support","sidebarTitle":"Moonrepo","href":"/integrations/moonrepo"},{"title":"Nix","sidebarTitle":"Nix","href":"/integrations/nix"},{"title":"Go","sidebarTitle":"Go","href":"/integrations/go"},{"title":"Git Checkouts","href":"/integrations/git-checkouts"},{"title":"Docker Images","description":null,"href":"/integrations/docker-images"},{"title":"Tailscale","href":"/integrations/tailscale"},{"title":"Integrating any framework","sidebarTitle":"Any framework","description":null,"href":"/integrations/any-framework"}\]}\]},{"tab":"CLI","icon":"square-terminal","pages":\[{"title":"CLI","href":"/reference/cli"}\]},{"tab":"SDK","icon":"braces","pages":\[{"title":"SDK","href":"/reference/sdk"}\]},{"tab":"MCP","icon":"plug","pages":\[{"title":"MCP","href":"/reference/mcp"}\]}\]},{"product":"Platform","description":"Lower-level primitives to build your own","pages":\[{"title":"Platform","href":"/platform"}\]}\]},"title":"Tailscale - Namespace Documentation","buildId":"dpl\_GvhK4qVXq51DpfYJLCtPpYNN4YHN","deploymentId":"dpl\_GvhK4qVXq51DpfYJLCtPpYNN4YHN","dynamics":\["07c022d89b","a74be98ba7"\],"chunks":\["Frame-5VlDM5Io.js","DynamicMarkdown-DO1Fz7ar.js","zoom-image-lightbox-uyuQJRFs.js","lightbox-handle-r17bVUz3.js"\]}