{"slug":"manage-tailscale-resources-using-pulumi","title":"Manage Tailscale resources using Pulumi","tags":["tailscale"],"agent_summary":"Last validated: Mar 3, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Manage Tailscale resources using Pulumi\r\n\r\nLast validated: Mar 3, 2025\r\n\r\n[Pulumi](https://www.pulumi.com/) is an infrastructure as code (IaC) tool that lets you deploy infrastructure programmatically. Pulumi maintains the [Tailscale Pulumi provider](https://www.pulumi.com/registry/packages/tailscale) in the Pulumi registry.\r\n\r\nYou can use the Tailscale Pulumi provider to:\r\n\r\n- Define your [ACLs](https://tailscale.com/docs/features/access-control/acls) using the [`Acl` resource](https://www.pulumi.com/registry/packages/tailscale/api-docs/acl).\r\n- Set [DNS settings](https://tailscale.com/docs/reference/dns-in-tailscale), including:\r\n  - Global nameservers using the [`DnsNameservers` resource](https://www.pulumi.com/registry/packages/tailscale/api-docs/dnsnameservers).\r\n  - Restricted nameservers for split DNS using the [`DnsSearchPaths` resource](https://www.pulumi.com/registry/packages/tailscale/api-docs/dnssearchpaths).\r\n  - [MagicDNS](https://tailscale.com/docs/features/magicdns) using the [`DnsPreferences` resource](https://www.pulumi.com/registry/packages/tailscale/api-docs/dnspreferences).\r\n- Generate an [auth key](https://tailscale.com/docs/features/access-control/auth-keys) (including setting whether it's reusable, ephemeral, pre-authorized, and tagged) using the [`TailnetKey` resource](https://www.pulumi.com/registry/packages/tailscale/api-docs/tailnetkey).\r\n- Manage properties of a device, including:\r\n  - [Device approval](https://tailscale.com/docs/features/access-control/device-management/device-approval) using the [`DeviceAuthorization` resource](https://www.pulumi.com/registry/packages/tailscale/api-docs/deviceauthorization).\r\n  - [Key expiry](https://tailscale.com/docs/features/access-control/key-expiry) using the [`DeviceKey` resource](https://www.pulumi.com/registry/packages/tailscale/api-docs/devicekey).\r\n  - [Tags](https://tailscale.com/docs/features/tags) using the [`DeviceTags` resource](https://www.pulumi.com/registry/packages/tailscale/api-docs/devicetags).\r\n  - [Subnet routes](https://tailscale.com/docs/features/subnet-routers) using the [`DeviceSubnetRoutes` resource](https://www.pulumi.com/registry/packages/tailscale/api-docs/devicesubnetroutes).\r\n\r\n## [Installation steps](https://tailscale.com/docs/integrations/pulumi-provider\\#installation-steps)\r\n\r\nTo use Pulumi with Tailscale:\r\n\r\n1. Install the package for the Tailscale Pulumi provider in [Node.js, Python, Go, or .NET](https://github.com/pulumi/pulumi-tailscale/blob/master/README.md#installing).\r\n\r\n2. Set the Tailscale configuration for Pulumi with an [API access token](https://tailscale.com/docs/reference/tailscale-api) for Tailscale and with the name of your tailnet. You can either [set these as environment variables or as part of your Pulumi configuration](https://www.pulumi.com/registry/packages/tailscale/installation-configuration/#configuring-the-provider). To set these in your Pulumi configuration:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\npulumi config set tailscale:apiKey tskey-1234567CNTRL-abcdefghijklmnopqrstu --secret\r\npulumi config set tailscale:tailnet example.com\r\n```\r\n\r\n\r\n## [Support](https://tailscale.com/docs/integrations/pulumi-provider\\#support)\r\n\r\nIf you have an issue or feature request, [file a GitHub issue](https://github.com/pulumi/pulumi-tailscale/issues).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Manage Tailscale resources using Pulumi</h1>\n<p>Last validated: Mar 3, 2025</p>\n<p><a href=\"https://www.pulumi.com/\">Pulumi</a> is an infrastructure as code (IaC) tool that lets you deploy infrastructure programmatically. Pulumi maintains the <a href=\"https://www.pulumi.com/registry/packages/tailscale\">Tailscale Pulumi provider</a> in the Pulumi registry.</p>\n<p>You can use the Tailscale Pulumi provider to:</p>\n<ul>\n<li>Define your <a href=\"https://tailscale.com/docs/features/access-control/acls\">ACLs</a> using the <a href=\"https://www.pulumi.com/registry/packages/tailscale/api-docs/acl\"><code>Acl</code> resource</a>.</li>\n<li>Set <a href=\"https://tailscale.com/docs/reference/dns-in-tailscale\">DNS settings</a>, including:\n<ul>\n<li>Global nameservers using the <a href=\"https://www.pulumi.com/registry/packages/tailscale/api-docs/dnsnameservers\"><code>DnsNameservers</code> resource</a>.</li>\n<li>Restricted nameservers for split DNS using the <a href=\"https://www.pulumi.com/registry/packages/tailscale/api-docs/dnssearchpaths\"><code>DnsSearchPaths</code> resource</a>.</li>\n<li><a href=\"https://tailscale.com/docs/features/magicdns\">MagicDNS</a> using the <a href=\"https://www.pulumi.com/registry/packages/tailscale/api-docs/dnspreferences\"><code>DnsPreferences</code> resource</a>.</li>\n</ul>\n</li>\n<li>Generate an <a href=\"https://tailscale.com/docs/features/access-control/auth-keys\">auth key</a> (including setting whether it's reusable, ephemeral, pre-authorized, and tagged) using the <a href=\"https://www.pulumi.com/registry/packages/tailscale/api-docs/tailnetkey\"><code>TailnetKey</code> resource</a>.</li>\n<li>Manage properties of a device, including:\n<ul>\n<li><a href=\"https://tailscale.com/docs/features/access-control/device-management/device-approval\">Device approval</a> using the <a href=\"https://www.pulumi.com/registry/packages/tailscale/api-docs/deviceauthorization\"><code>DeviceAuthorization</code> resource</a>.</li>\n<li><a href=\"https://tailscale.com/docs/features/access-control/key-expiry\">Key expiry</a> using the <a href=\"https://www.pulumi.com/registry/packages/tailscale/api-docs/devicekey\"><code>DeviceKey</code> resource</a>.</li>\n<li><a href=\"https://tailscale.com/docs/features/tags\">Tags</a> using the <a href=\"https://www.pulumi.com/registry/packages/tailscale/api-docs/devicetags\"><code>DeviceTags</code> resource</a>.</li>\n<li><a href=\"https://tailscale.com/docs/features/subnet-routers\">Subnet routes</a> using the <a href=\"https://www.pulumi.com/registry/packages/tailscale/api-docs/devicesubnetroutes\"><code>DeviceSubnetRoutes</code> resource</a>.</li>\n</ul>\n</li>\n</ul>\n<h2><a href=\"https://tailscale.com/docs/integrations/pulumi-provider#installation-steps\">Installation steps</a></h2>\n<p>To use Pulumi with Tailscale:</p>\n<ol>\n<li>\n<p>Install the package for the Tailscale Pulumi provider in <a href=\"https://github.com/pulumi/pulumi-tailscale/blob/master/README.md#installing\">Node.js, Python, Go, or .NET</a>.</p>\n</li>\n<li>\n<p>Set the Tailscale configuration for Pulumi with an <a href=\"https://tailscale.com/docs/reference/tailscale-api\">API access token</a> for Tailscale and with the name of your tailnet. You can either <a href=\"https://www.pulumi.com/registry/packages/tailscale/installation-configuration/#configuring-the-provider\">set these as environment variables or as part of your Pulumi configuration</a>. To set these in your Pulumi configuration:</p>\n</li>\n</ol>\n<pre><code class=\"language-shell\">pulumi config set tailscale:apiKey tskey-1234567CNTRL-abcdefghijklmnopqrstu --secret\r\npulumi config set tailscale:tailnet example.com\n</code></pre>\n<h2><a href=\"https://tailscale.com/docs/integrations/pulumi-provider#support\">Support</a></h2>\n<p>If you have an issue or feature request, <a href=\"https://github.com/pulumi/pulumi-tailscale/issues\">file a GitHub issue</a>.</p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}