Tailscale Kubernetes operator v1.78.1

A new release of the Tailscale Kubernetes operator is available. For guidance on installing and updating, see installation instructions.

• New: Tailscale client metrics can be enabled using a ProxyClass with the .spec.metrics.enable field set.

• New: All Tailscale container images are annotated with Open Container Initiative (OCI) annotations.

• New: ProxyClass supports configuring topology spread constraints for the Proxy Pods.

• New: Connector Custom Resource Definition (CRD) can be used to configure the Kubernetes Operator to deploy a Tailscale app connector on Kubernetes.

• New: Tailscale running on Kubernetes and using a Kubernetes Secret as a state store writes Kubernetes Events to its Pod when changes occur to the state stored in the Kubernetes Secret. The same is true when there are errors related to reading or writing the state. This should help debugging issues related to transient errors when talking to the Kubernetes API server to retrieve or update the state Secret.

• New: Kubernetes Operator can optionally create a Prometheus ServiceMonitor for proxy resources that have Tailscale client metrics enabled.

• New: Container Storage Interface (CSI) driver volume for the operator's OAuth client credentials can be configured by using Helm values.

• New: Kubernetes Ingress has clearer warnings if it has been deployed to a tailnet that has no HTTPS enabled. Specifically, a new warning in proxy logs and empty hostname on the Ingress status.

• Changed: tailscale.com/tailnet-ip annotation is validated that it holds a valid IP address.

• Changed: Timeout for Kubernetes API server calls for reading/updating tailscaled state stored in a Kubernetes Secret has been changed from 5 seconds to the total of 30 seconds for the read/update operation and an operation to emit an Event about the state update. This should reduce errors related to slow API server connections.

• Changed: The ProxyClass field .spec.metrics.enable enables metrics at both /metrics and /debug/metrics, but /debug/metrics is deprecated. Users relying on /debug/metrics need to set .spec.statefulSet.pod.tailscaleContainer.debug.enable (which is a new field in Tailscale 1.78.1) until Tailscale 1.82.0 releases. When 1.82.0 releases, /metrics and /debug/metrics will both independently default to false.

• Changed: Kubernetes operator proxy containers created for ingress and egress Service resources, Connectors and ProxyGroups are privileged. This is needed because of recent changes in containerd. For more context, see tailscale/tailscale/pull/14262.

• Fixed: Tailscale running on Kubernetes reads its state from a Secret only once, and that is upon initial start. This should reduce bugs caused by transient issues when connecting to the Kubernetes API server as well as reduce the load on the API server and improve latency for state operations.

• Fixed: Kubernetes Egress Service ports for ProxyGroup can be changed from a single unnamed port to one or more named ports.

• Fixed: Clients should more accurately detect whether they are in a container when checking for updates.