Skip to content

Tailscale PAM

The optional pam collector reads the separate Border0 API used by Tailscale PAM. It collects connector, service, policy and identity inventory, organization settings, subscription limits, and session telemetry. Tailscale OAuth credentials do not authenticate these requests.

Enable collection

Supply a Border0 service-account bearer token with read access to the required PAM resources. The client makes GET requests and does not refresh the token. Keep it in the environment:

export TS2OTEL_PAM__TOKEN='<border0-service-account-token>'

Add this to an otherwise configured exporter:

collectors:
  pam:
    enabled: true
    interval: 10m
    sessions_interval: 1m
    snapshot_enabled: false
    session_log_enabled: false

There is no pam.token_file setting. pam.api_url defaults to https://api.border0.com/api/v1. In a multi-tailnet configuration, set pam.tailnet to the exact name of the runtime that should own the signals. Empty selects the first configured runtime; unknown names fail validation. One process has one PAM configuration, not one per tailnet.

Check configuration with -validate, then use the preflight workflow to check collection. Inspect the collector's status and API error classes. A 403 is scope_denied, not evidence that PAM is unavailable; a token needs access to each resource being collected.

Inventory, snapshots and sessions

Inventory runs every ten minutes by default. Session collection has its own one-minute schedule. The PAM metrics catalog lists each signal and its labels. Tailscale Service VIPs and ports belong to the services collector; PAM-related configuration audit changes belong to auditlogs.

Two additional log outputs are disabled by default:

  • collectors.pam.snapshot_enabled emits tailscale.pam.snapshot when the safe configuration shape changes and on a heartbeat, which defaults to 24 hours. The snapshot excludes credential material and is bounded by snapshot_body_bytes, default 32 KiB.
  • collectors.pam.session_log_enabled emits tailscale.pam.session for accepted session records. Identifier fields follow pii_filter. Categories retain identifiers by default; set the relevant categories to false before exporting records that must omit them.

Session results describe authorization outcomes for sessions that reached a connector. They do not measure connection health or all access attempts: grant-layer denials are absent from the session feed. The active-session gauge covers the newest-first prefix read by the poller, so it must not be treated as a complete census of arbitrarily old sessions.

Use the configuration reference for connection settings and collector settings for output limits.