Track AI agent infrastructure deployment

[planeyang]

Overview

Track the full lifecycle of deploying Tailscale-based network isolation for AI agents. Design and IaC code is in PR #6.

Phases

Phase 1: Design & IaC (in progress)

• Design architecture (Tailscale ACLs, isolated VPC, egress proxy)
• Write modular Terraform code (PR Add Tailscale infrastructure for isolated AI agent networking #6)
• Review and merge PR Add Tailscale infrastructure for isolated AI agent networking #6

Phase 2: Prerequisites

• Create Tailscale account and tailnet for the org
• Configure identity provider (Google Workspace / Okta / Azure AD)
• Generate Tailscale API key and store in secrets manager
• Choose cloud provider (AWS or GCP) and set up credentials
• Create terraform.tfvars with team emails, region, instance config

Phase 3: Deploy Core Infrastructure

• terraform init + terraform plan — review the plan
• Deploy agent network (VPC, subnets, NAT, security groups)
• Deploy subnet router and approve routes in Tailscale admin
• Deploy egress proxy with domain allowlist
• Verify Tailscale ACLs are enforced (test denied routes)

Phase 4: Deploy AI Agents

• Build agent container image / runtime
• Deploy agent instances with ephemeral Tailscale keys
• Configure agents to use egress proxy (HTTP_PROXY / HTTPS_PROXY)
• Verify agents can reach sandbox services and allowed external APIs
• Verify agents CANNOT reach corporate intranet

Phase 5: Operational Readiness

• Enable Tailscale audit logging and pipe to SIEM
• Set up alerts for denied connection attempts from agents
• Document runbook for adding/removing allowed domains
• Document runbook for onboarding new agent types
• Set up key rotation for Tailscale auth keys

Phase 6: Ongoing Maintenance

• Review and update egress proxy allowlist as needed
• Review ACL policy quarterly
• Terraform state backup strategy
• Plan for multi-region / multi-cloud expansion (GCP module ready but commented out)

References

• Infrastructure code: PR Add Tailscale infrastructure for isolated AI agent networking #6
• Architecture overview: infrastructure/README.md
• Module docs: each module has its own README.md