Tailscale Auth Keys Expire, Causing Node Disconnection

[ysicing]

The Auth keys of the tailscale expire, causing the current node to lose contact with the Expiry disabled set in the console

Aug 20 12:55:16 k01 k3s[3444072]: time="2024-08-20T12:55:16+08:00" level=info msg="Starting VPN: tailscale"
Aug 20 12:55:43 k01 k3s[3444072]: time="2024-08-20T12:55:43+08:00" level=fatal msg="tailscale up failed: backend error: invalid key: API key does not exist\n: exit status 1"
Aug 20 12:55:43 k01 systemd[1]: k3s.service: Main process exited, code=exited, status=1/FAILURE
Aug 20 12:55:43 k01 systemd[1]: k3s.service: Failed with result 'exit-code'.

[brandond]

This doesn't seem to be something we can fix on our side? If your keys expire, you should renew them periodically.

[ysicing]

The maximum duration of the auth key is only 90 days, and when there are more nodes, rotating this is also a more tedious and repetitive thing. Normally, tailscale up doesn't ask for revalidation for a long time. Between I see k3s process has called reset related commands, is there a better practical way?

[ashesofdream]

@brandond Same question .I think should not auth by key everytime restart the k3s. Maybe it should have a way to reuse authorized tailscale interface?

[ashesofdream]

@brandond

k3s/pkg/vpn/vpn.go

Line 53 in 0d48c8e

"up", "--authkey", authInfo.JoinKey, "--timeout=30s", "--reset",

Maybe remove default --reset flag will work?

[geekuillaume]

I just got the same problem, is there a reason we are passing --reset here? From what I understand, when first joining the tailnet, the JoinKey is used to generate a permanent Node Key that will persist between reboots. But because k3s pass the --reset argument, this key gets cleared on the next reboot and then the node tries to reuse the join key (which could be invalid by then). Can we remove the --reset argument?