Tailscale Kubernetes Operator v1.102.2

A new release of the Tailscale Kubernetes Operator is available. For guidance on installing and updating, refer to our installation instructions.

• New: PeerRelays are deployable in-cluster via a custom resource.
• New: Annotations can now be applied to the operator's deployment resource via Helm.
• New: Workload identity federation can now be configured for the Tailnet custom resource.
• New: 4via6 is supported in connector and egress proxy resources when egressing from a dual-stack cluster.
• New: IPv6 is supported in Egress ProxyGroups.
• Changed: Operator log output excludes superfluous entries, such as entries for resources that do not contain annotations.
• Changed: Several log lines have adjusted log levels.
• Fixed: MTU values are clamped on both the input and output interfaces, where previously only the output interface was clamped.
• Fixed: ProxyGroup services no longer fail to reconcile when using the same hostname across multiple tailnets.
• Fixed: ProxyGroup static endpoints no longer cause constant reconciliation loops due to non-deterministic ordering.
• Fixed: DNS reconciler no longer drops reconcile events, which left the dnsrecords ConfigMap stale.
• Fixed: EndpointSlices for Egress ProxyGroup are verified on every reconcile.
• Fixed: Cert renewal retries follow Let's Encrypt's recommended backoff schedule instead of a fixed interval.
• Fixed: Let's Encrypt Retry-After headers are honored by Kubernetes proxies when hitting rate limits, which avoids the tight retry loops that made rate-limit backoffs worse.
• Fixed: Per-attempt cert issuance timeout in Kubernetes proxies is increased to 30 minutes, giving ACME challenges room to complete under load without failing prematurely.
• Fixed: Cert issuance attempts no longer run against a VIPService that is being torn down during Ingress deletion, which wasted Let's Encrypt rate-limit quota.