submitaticket

Long enough to authenticate the node into the Tailnet. Short enough to revoke itself before the Agent can use it.

Not the quickest win if you're spinning up ephemeral runners for CI.

Where is he preaching the religion of short-living credentials. He literally agrees with the high cost/friction to implement.

> Unfortunately, dynamic credentials are a lot of work to set up and maintain. When security requires work, people don't do it.

It would not have prevented the initial exploit. The agent gained access to the K8s cluster and read the Tailscale Auth Key from Cluster Secrets. A short-lived credential would reduce the risk that the key is still valid when an agent gains access.