Releasesby GlyphPublic IP address device posture attribute
The ip:publicAddress device posture attribute is now generally available. It can be used in posture checks and is visible in the Tailscale admin console.
Tailscale Release notes from Tailscale
180 releases · 4 this month
Device Provisioning with OAuth Apps
Tailscale has made Device Provisioning via OAuth Apps generally available, allowing for programmatic management of device provisioning through the Tailscale API.
MagicRoute
- New: Use MagicRoute ( beta ) to choose between redundant subnet routers, app connectors, exit nodes, and Tailscale Service hosts. Changed: Configure how the tailnet performs Route selection , replacing the toggle that enabled Regional Routing in the admin console.
Self-serve identity provider changes GA
- Changed: Users with the Owner role can switch their tailnet's identity provider from the admin console for supported providers ( generally available ).
Device Posture Monitoring and Alerts
Configure monitoring and alerts for device posture (beta) to help admins and end-users diagnose connectivity problems caused by failing posture. New: Badges can be shown on the Machines page of the admin console when a device is failing a posture (beta) . New: The Failing Posture filter on the Machines page shows devices that are failing selected postures.
Declarative node sharing
- New: Declarative node sharing lets tailnet admins use policy to securely share resources between trusted tailnets ( alpha ).
Tailscale PAM
- Changed: The PAM web client at my.tailscale.com runs as a single browser-based Tailscale device that is shared across all of your browser tabs. After authenticating once, connecting to a service in a new tab no longer requires you to reauthenticate for every subsequent connection.
View device posture status
- When checking the device posture status of a machine on the Machines page of the admin console, you can see the assertions the posture requires, each machine's value, and whether it's passing. For each posture, you can also see a count of policy file rules that affect a machine and require this posture.
Tailscale GitHub Action v4.2.0
- Fixed: The Tailscale GitHub Action properly skips re-downloading binaries on linux if a file with a matching SHA already exists. New: The Tailscale GitHub Action groups log output by default. Use the log-mode parameter to control whether the logging output is grouped, ungrouped, or run in "quiet" mode.
Tailscale PAM
Use Tailscale Privileged Access Management (PAM) ( beta ) to provide application-aware access to resources in your Tailscale network. New: Services can be defined for privileged access, including SSH , database , RDP , HTTPS , Kubernetes , and Amazon S3 types. New: Sessions can be recorded for SSH, database, HTTPS, and Kubernetes Service types.
Aperture by Tailscale GA
Use Aperture ( generally available ) to secure and manage AI agents and LLM sessions with cost controls, request and response hooks, guardrails, logging, MCP support, and API proxying. New: A promotional model token credit is included for use with new and existing Aperture gateways.
Tailnet list API pagination
- Changed: The list tailnets endpoint paginates results. By default, organizations with more than 100 tailnets now receive only the first 100 results, with totalCount and cursor parameters to retrieve additional results. New: limit and cursor query parameters are supported on the list tailnets endpoint.
Tailnet creation API
- New: Use the tailnet creation API to create, list, and delete API-only tailnets in your organization ( alpha ).
Admin console URL change
- Changed: The Tailscale admin console is now available at console.tailscale.com . Authentication continues to use login.tailscale.com , and requests to login.tailscale.com/admin/ automatically redirect to the new subdomain.
Nested group support for synced groups
- New: Microsoft Entra ID and Google Workspace group sync includes members of nested groups.
Self-serve identity provider changes
- New: Users with the Owner role can switch their tailnet's identity provider from the admin console for supported providers ( beta ).
Device Provisioning with OAuth Apps
- New: Create and manage OAuth Apps for Device Provisoning with the Tailscale API (alpha) .
Public IP address device posture attribute
- New: ip:publicAddress device posture attribute is available for use in postures and viewable on the Machines page of the admin console. To test, go to the Settings page of the admin console and toggle Public IP addresses for device posture (beta) .
Tailnet system policy values
- Changed: The Tailnet system policy accepts a comma-separated list of tailnet IDs or organization IDs.
Log streaming integration with Azure Blob Storage
- New: Tailscale network flow logs and configuration audit logs can be streamed to Azure Blob Storage .
Aperture chat, connectors, and sandboxes
- New: Use identity-aware connectors to let agents and users reach your data via MCP and API endpoints ( alpha ). Tailnet access controls apply to every request, giving you one identity system across the chat interface and any agent connected to your tailnet.
Group visibility on Tailscale clients
- New: Configure devices in your tailnet to receive group membership information from the Tailscale control plane ( alpha ).
Preset app support for Oracle Cloud Infrastructure (OCI)
- New: Preset apps are available for Oracle Cloud Infrastructure (OCI) , including per-region compute and networking, per-region Object Storage, and a global preset for the Oracle Services Network (OSN).
Aperture CLI
Use Aperture CLI ( alpha ) to launch and manage coding agents with Aperture 's built in guardrails, policy enforcement, and observability. Aperture CLI supports Claude Code, Gemini CLI, OpenCode, OpenAI Codex, Copilot CLI, and Claude Cowork, on devices both inside and outside your tailnet.
Manage domain names
- New: Manage domain verification and domain aliases for your tailnet using the Domains page of the admin console.
Tailscale Terraform Provider v0.29.0
v0.29.0 of the Tailscale Terraform Provider has been released with the following changes: New: Use the tailscale_service resource and tailscale_service data source to manage Tailscale Services . New: Set identity_token_environment_variable_name in the provider to specify the environment variable to read an identity token from.
Purchase additional tagged resources
- New: All plans can purchase additional tagged resources above the included 50-device limit. New: All plans can view the number of tagged resources in their tailnet that count against the usage limit.
View device posture status
- New: View the device posture status of a machine in your tailnet by using the Machines page of the admin console.
GitOps for Tailscale with GitHub Actions v1.5.2
A new release of GitOps for Tailscale with GitHub Actions is available. You can download it from the GitHub Actions Marketplace . Fixed: Update dependencies to remove Node 20 deprecation warning.
Aperture
Use Aperture ( beta ) to secure and manage your LLM agents with a single control plane across all your providers and models. New: Create custom guardrails with pre-LLM-call hooks to strip or block PII and restrict specific agent tools before requests reach the LLM.
Seat calculator
- New: A seat calculator is available to help you understand seat consumption on your account before upgrading to a new plan.
New pricing and packaging
- Changed: New tailnet plan signups are billed based on occupied user seats instead of monthly active users. Existing tailnets on a legacy plan will continue to be billed based on monthly active users. Changed: All plans can have an unlimited number of user devices in a tailnet.
Workload identity federation GA
- Changed: Use workload identity federation ( generally available ) to authenticate Tailscale API requests with federated OIDC workload identities from third-party providers.
Tailscale Peer Relays GA
- Changed: Use Tailscale Peer Relays to set up self-hosted high-throughput relay servers when direct connections aren't possible ( generally available ).
Aperture by Tailscale
- New: Use Aperture by Tailscale to secure and monitor LLM sessions and AI agents ( alpha ).
Tailscale Kubernetes Operator v1.94.1
A new release of the Tailscale Kubernetes Operator is available. For guidance on installing and updating, refer to our installation instructions . New: The Egress proxy can now send traffic to Tailscale service VIPs.
Log streaming integration with Google Cloud Storage
- New: Tailscale network flow logs and configuration audit logs can be streamed to Google Cloud Storage (GCS).
Workload identity federation updates
- New: Workload identity federation supports provider-native identity token authentication for GitOps for Tailscale with GitHub Actions and GitOps for Tailscale with GitLab CI . New: Token exchange error details for a federated identity can be found in the Trust credentials page of the admin console.
Tailscale Services GA
- Changed: Use Tailscale Services to decouple applications and services from the devices that host them ( generally available ).
IS SET and NOT SET device posture operators
- New: IS SET and NOT SET have been added as device posture operators.
India DERP Region City Name updated
- Changed: The city name for the DERP server hosted in India has been updated to reflect the official name of Bengaluru. The hosting provider and IP addresses remain unchanged.
Workload identity federation API
- New: The Tailscale API supports creating, reading, updating, and deleting federated identities . New: tailscale-client-go-v2 can configure federated identities . New: The Tailscale Terraform provider can configure federated identities .
IP changes to Tailscale's logging infrastructure
- Changed: The domain log.tailscale.com resolves to static IP address ranges registered and managed by Tailscale. If IP-based rules are required for your firewall, use the IPv4 range 199.165.136.0/24 and the IPv6 range 2606:B740:1::/48 . Note: In most cases, you do not need to configure firewall rules to use Tailscale.
Workload identity federation
- New: Use workload identity federation ( beta ) for creation of federated OIDC workload identities from third-party providers to authenticate requests to the Tailscale API . New: tailscale-client-go-v2 can use workload identity federation for authentication. New: The Tailscale Terraform provider can use workload identity federation for authentication.
Tailscale Peer Relays
- New: Use Tailscale Peer Relays for client-to-client connections when direct connections aren't possible ( beta ).
Tailscale Services
- New: Use Tailscale Services to decouple applications and services from the devices that host them ( beta ).
Tailscale v1.90.3
All platforms Fixed: tailscaled shuts down as expected and without panic. Linux Fixed: tailscaled starts up as expected in a no router configuration environment. macOS Fixed: The Tailscale dock icon closes as expected when the client is not using the windowed UI ( beta ).
Tailscale v1.90.1
Note : 1.90.0 was a release candidate intended for testing only. All platforms New: Clients can use configured DNS resolvers for all domains even when the client also uses an exit node using the nameserver settings in the DNS page of the admin console.
Tailnet name type changes in the admin console
Note : For more in-depth details about all the tailnet names and types, refer to tailnet names and types . New: The Display name field is added to the Settings > General page of the admin console.
Preset app support for Amazon AWS, Salesforce (Hyperforce), and Microsoft 365
- New: Preset apps are available for Amazon AWS services such as Amazon CloudFront, Amazon EC2, and Amazon S3, Salesforce (Hyperforce) , and Microsoft 365 .
Expanded `autogroup:self` compatibility
- Updated: Use autogroup:self as a destination for any grant, ACL, or SSH src that includes autogroup:<role> , groups, or individual users in the tailnet policy file.
Updated devices API
- Changed: The Read and List endpoint responses in the Devices API include a connectedToControl flag, which indicates whether the device has recently connected to the Tailscale control server. Changed: The lastSeen field is included only when connectedToControl is false.
About and activity
Clients, the admin console and the coordination server.
Releases per month
10Jun
8Jul
14Aug
8Sep
15Oct
4Nov
Official release-notes pages 1
| Release-notes page | Site | Feed |
|---|---|---|
| Changelog tailscale.com | tailscale.com | None |