A new release of the Tailscale Kubernetes operator is available. For guidance on installing and updating, refer to our installation instructions . Note: This version contains no changes except for library updates.
- New: Use workload identity federation ( beta ) for creation of federated OIDC workload identities from third-party providers to authenticate requests to the Tailscale API . New: tailscale-client-go-v2 can use workload identity federation for authentication. New: The Tailscale Terraform provider can use workload identity federation for authentication.
- New: Use Tailscale Peer Relays for client-to-client connections when direct connections aren't possible ( beta ).
- New: Use Tailscale Services to decouple applications and services from the devices that host them ( beta ).
All platforms Fixed: tailscaled shuts down as expected and without panic. Linux Fixed: tailscaled starts up as expected in a no router configuration environment. macOS Fixed: The Tailscale dock icon closes as expected when the client is not using the windowed UI ( beta ).
- Fixed: The Tailscale GitHub Action stops the background Tailscale processes when a CI job finishes. Fixed: The Tailscale GitHub Action validates that tags are specified when using an OAuth client.
Note : 1.90.0 was a release candidate intended for testing only. All platforms New: Clients can use configured DNS resolvers for all domains even when the client also uses an exit node using the nameserver settings in the DNS page of the admin console.
Note : For more in-depth details about all the tailnet names and types, refer to tailnet names and types . New: The Display name field is added to the Settings > General page of the admin console.
- Fixed: The Tailscale GitHub Action no longer logs the output of all shell commands to the runner's console unless debug logging is enabled. Fixed: The Tailscale GitHub Action masks authentication secrets in logs unless debug logging is enabled.
- New: Preset apps are available for Amazon AWS services such as Amazon CloudFront, Amazon EC2, and Amazon S3, Salesforce (Hyperforce) , and Microsoft 365 .
- Updated: Use autogroup:self as a destination for any grant, ACL, or SSH src that includes autogroup:<role> , groups, or individual users in the tailnet policy file.
- Changed: The Read and List endpoint responses in the Devices API include a connectedToControl flag, which indicates whether the device has recently connected to the Tailscale control server. Changed: The lastSeen field is included only when connectedToControl is false.
Releasesby Glyph