types: stop sending machine keys in map entries

Stable identity that outlives node key rotation. SaaS sends it on no entry; no
client from our minimum version on acts on it.

Updates #3626

hscontrol/mapper/tail_test.go

@@ -133,9 +133,6 @@ func TestTailNode(t *testing.T) {
 				),
 				KeyExpiry: expire,
 
-				Machine: mustMK(
-					"mkey:f08305b4ee4250b95a70f3b7504d048d75d899993c624a26d422c67af0422507",
-				),
 				DiscoKey: mustDK(
 					"discokey:cf7b0fd05da556fdc3bab365787b506fd82d64a70745db70e00e86c1b1c03084",
 				),

hscontrol/servertest/mapstream_compat_test.go

@@ -60,8 +60,6 @@ var mapStreamSkipReasons = map[string]string{
 	"map-delivery/S3.5-remove/db1/frames":  policyResponseToEveryNode,
 	"map-delivery/S3.5-restore/db1/frames": policyResponseToEveryNode,
 
-	"map-delivery/S2.0/own-entry/Machine":            machineKeySent,
-	"map-delivery/S2.0/peer-entry/Machine":           machineKeySent,
 	"map-delivery/S2.0/peer-entry/MachineAuthorized": peerAuthorizedSent,
 	"map-delivery/S2.0/own-entry/Cap":                ownCapSent,
 	"map-delivery/S2.0/own-entry/Online":             ownOnlineSent,
@@ -105,7 +103,6 @@ var mapStreamSkipReasons = map[string]string{
 const (
 	policyResponseToEveryNode = "POLICY_RESPONSE_TO_EVERY_NODE: headscale sends every connected node a policy response when the policy, a node's tags or approved routes, or the set of nodes change; SaaS sends only the nodes whose peers or filter change"
 	restartEndpointsKept      = "RESTART_ENDPOINTS_KEPT: headscale keeps a restarted node's last endpoints at its peers until it reports new ones; SaaS sends peers the node without endpoints until then"
-	machineKeySent            = "MACHINE_KEY_SENT: headscale puts a node's machine key on its own entry and on its peers' copies; SaaS on neither"
 	peerAuthorizedSent        = "PEER_AUTHORIZED_SENT: headscale sets MachineAuthorized on peer entries; SaaS only on a node's own"
 	ownCapSent                = "OWN_CAP_SENT: headscale sets Cap on a node's own entry; SaaS only on peers"
 	ownOnlineSent             = "OWN_ONLINE_SENT: headscale sets Online on a node's own entry; SaaS only on peers"

hscontrol/types/node.go

@@ -1471,7 +1471,6 @@ func (nv NodeView) TailNode(
 		Key:       nv.NodeKey(),
 		KeyExpiry: keyExpiry,
 
-		Machine:       nv.MachineKey(),
 		DiscoKey:      nv.DiscoKey(),
 		Addresses:     addresses,
 		PrimaryRoutes: primaryRoutes,

integration/helpers.go

@@ -809,7 +809,6 @@ func assertValidNetmap(t *testing.T, client TailscaleClient) {
 		assert.Truef(c, netmap.SelfNode.Online().Get(), "%q is not online", client.Hostname())
 
 		assert.Falsef(c, netmap.SelfNode.Key().IsZero(), "%q does not have a valid NodeKey", client.Hostname())
-		assert.Falsef(c, netmap.SelfNode.Machine().IsZero(), "%q does not have a valid MachineKey", client.Hostname())
 		assert.Falsef(c, netmap.SelfNode.DiscoKey().IsZero(), "%q does not have a valid DiscoKey", client.Hostname())
 
 		for _, peer := range netmap.Peers {
@@ -829,7 +828,6 @@ func assertValidNetmap(t *testing.T, client TailscaleClient) {
 			assert.Truef(c, peer.Online().Get(), "peer (%s) of %q is not online", peer.ComputedName(), client.Hostname())
 
 			assert.Falsef(c, peer.Key().IsZero(), "peer (%s) of %q does not have a valid NodeKey", peer.ComputedName(), client.Hostname())
-			assert.Falsef(c, peer.Machine().IsZero(), "peer (%s) of %q does not have a valid MachineKey", peer.ComputedName(), client.Hostname())
 			assert.Falsef(c, peer.DiscoKey().IsZero(), "peer (%s) of %q does not have a valid DiscoKey", peer.ComputedName(), client.Hostname())
 		}
 	}, 10*time.Second, 200*time.Millisecond, "Waiting for valid netmap for %q", client.Hostname())