feat: run platform gateway through Tailscale sidecar

2026-08-12 18:11:24 +09:00
parent c90e8d5745
commit 204300c927
5 changed files with 74 additions and 2 deletions
@@ -30,3 +30,16 @@ Default URL: `http://localhost:4500`
 ## Network Model

 Students and instructors never connect directly to Headscale/Tailscale device endpoints. Clients call this gateway only. The gateway verifies auth, checks platform grants/session ownership, records audit context, and proxies allowed operations to the mobility agent running on each platform node.
+
+## Kubernetes Tailscale Sidecar
+
+The Kubernetes deployment runs a Tailscale sidecar in the same network namespace as
+the gateway. Create the one-time Headscale key secret before the first deployment:
+
+```bash
+kubectl -n studio-system create secret generic platform-gateway-tailscale-auth \
+  --from-literal=authkey='tskey-auth-...'
+```
+
+The sidecar persists its machine state in `platform-gateway-tailscale-state`, so
+subsequent Gateway pod restarts do not consume another pre-auth key.