Tailscale Kubernetes Operator v1.104.1

A new release of the Tailscale Kubernetes Operator is available. For guidance on installing and updating, refer to our installation instructions.

• New: Ingress ProxyGroups can share a single persistent Let's Encrypt account key per tailnet to ensure certificate renewals keep their exemption from Let's Encrypt rate limits.
• New: PeerRelay resources support a custom UDP port and additional static endpoints for peers that cannot reach the relay at its load balancer address.
• New: The DNSConfig custom resource supports image pull secrets for nameserver pods.
• New: The operator Helm chart supports the nameOverride and fullnameOverride values to customize the names of the resources it installs.
• Changed: The operator Helm chart applies image pull secrets to every ServiceAccount it creates. Previously, it applied them only to the operator ServiceAccount.
• Changed: Rolling updates of egress ProxyGroups wait for each new pod to route traffic to all of its egress Services before moving on to the next pod.
• Changed: Ingress resources annotated with tailscale.com/experimental-forward-cluster-traffic-via-ingress remain reachable from inside the cluster. Tailscale Serve on Linux now listens only on the Tailscale interface, so the operator sets TS_SERVE_ALLOW_ALL_INTERFACES on the proxies for these Ingress resources.
• Changed: The operator uses controller-runtime v0.23.3.
• Fixed: PeerRelay resources use the coordination server URL configured for the operator.
• Fixed: PeerRelay replicas re-authenticate after losing their login, such as when the device is deleted or its auth key expires.
• Fixed: The ProxyGroupPolicy resource no longer rejects Ingress and Service resources that have no annotations.
• Fixed: The operator cleans up a high availability Service after you remove its tailscale.com/proxy-group annotation. Previously, the Tailscale Service stayed advertised, and the Kubernetes Service could get stuck in the Terminating state after deletion.