summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2026-01-23ssh/tailssh: fix observed crash in Tailscale SSHbradfitz/tailssh_crashBrad Fitzpatrick1-1/+1
Updates tailscale/corp#36268 Change-Id: Ie9da0da59808a5475dc41c67376ee73ccd254486 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-01-22tsnet: add support for a user-supplied tun.DeviceJames Tucker3-5/+842
tsnet users can now provide a tun.Device, including any custom implementation that conforms to the interface. netstack has a new option CheckLocalTransportEndpoints that when used alongside a TUN enables netstack listens and dials to correctly capture traffic associated with those sockets. tsnet with a TUN sets this option, while all other builds leave this at false to preserve existing performance. Updates #18423 Signed-off-by: James Tucker <james@tailscale.com>
2026-01-22tsnet: clarify that ListenService starts the server if necessaryHarry Harpham1-0/+2
Every other listen method on tsnet.Server makes this clarification, so should ListenService. Fixes tailscale/corp#36207 Signed-off-by: Harry Harpham <harry@tailscale.com>
2026-01-22wgengine: send disco key via TSMP on first contact (#18215)Claus Lensbøl3-4/+67
When we have not yet communicated with a peer, send a TSMPDiscoAdvertisement to let the peer know of our disco key. This is in most cases redundant, but will allow us to set up direct connections when the client cannot access control. Some parts taken from: #18073 Updates #12639 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2026-01-21net/udprelay: add tailscaled_peer_relay_endpoints gauge (#18265)Alex Valiushko4-24/+258
New gauge reflects endpoints state via labels: - open, when both peers are connected and ready to talk, and - connecting. when at least one peer hasn't connected yet. Corresponding client metrics are logged as - udprelay_endpoints_connecting - udprelay_endpoints_open Updates tailscale/corp#30820 Change-Id: Idb1baa90a38c97847e14f9b2390093262ad0ea23 Signed-off-by: Alex Valiushko <alexvaliushko@tailscale.com>
2026-01-21util/limiter: don't panic when dumping a new LimiterJosh Bleecher Snyder2-0/+8
Fixes #18439 Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>
2026-01-21cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)David Bond31-64/+1730
This commit contains the implementation of multi-tailnet support within the Kubernetes Operator Each of our custom resources now expose the `spec.tailnet` field. This field is a string that must match the name of an existing `Tailnet` resource. A `Tailnet` resource looks like this: ```yaml apiVersion: tailscale.com/v1alpha1 kind: Tailnet metadata: name: example # This is the name that must be referenced by other resources spec: credentials: secretName: example-oauth ``` Each `Tailnet` references a `Secret` resource that contains a set of oauth credentials. This secret must be created in the same namespace as the operator: ```yaml apiVersion: v1 kind: Secret metadata: name: example-oauth # This is the name that's referenced by the Tailnet resource. namespace: tailscale stringData: client_id: "client-id" client_secret: "client-secret" ``` When created, the operator performs a basic check that the oauth client has access to all required scopes. This is done using read actions on devices, keys & services. While this doesn't capture a missing "write" permission, it catches completely missing permissions. Once this check passes, the `Tailnet` moves into a ready state and can be referenced. Attempting to use a `Tailnet` in a non-ready state will stall the deployment of `Connector`s, `ProxyGroup`s and `Recorder`s until the `Tailnet` becomes ready. The `spec.tailnet` field informs the operator that a `Connector`, `ProxyGroup`, or `Recorder` must be given an auth key generated using the specified oauth client. For backwards compatibility, the set of credentials the operator is configured with are considered the default. That is, where `spec.tailnet` is not set, the resource will be deployed in the same tailnet as the operator. Updates https://github.com/tailscale/corp/issues/34561
2026-01-20version: add support for reporting the mac variant from tailscale --version ↵Jonathan Nobels1-7/+74
(#18462) fixes tailscale/corp#27182 tailscale version --json now includes an osVariant field that will report one of macsys, appstore or darwin. We can extend this to other platforms where tailscaled can have multiple personalities. This also adds the concept of a platform-specific callback for querying an explicit application identifier. On Apple, we can use CFBundleGetIdentifier(mainBundle) to get the bundle identifier via cgo. This removes all the ambiguity and lets us remove other less direct methods (like env vars, locations, etc). Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2026-01-19net/udprelay: advertise addresses from cloud metadata service (#18368)Alex Valiushko2-5/+25
Polls IMDS (currently only AWS) for extra IPs to advertise as udprelay. Updates #17796 Change-Id: Iaaa899ef4575dc23b09a5b713ce6693f6a6a6964 Signed-off-by: Alex Valiushko <alexvaliushko@tailscale.com>
2026-01-19k8s-operator,kube: remove enableSessionRecording from Kubernetes Cap Map ↵Tom Meadows2-14/+4
(#18452) * k8s-operator,kube: removing enableSessionRecordings option. It seems like it is going to create a confusing user experience and it's going to be a very niche use case, so we have decided to defer this for now. Updates tailscale/corp#35796 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> * k8s-operator: adding metric for env var deprecation Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> --------- Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
2026-01-19net/portmapper: Stop replacing the internal port with the upnp external port ↵Eduardo Sorribas1-1/+1
(#18349) net/portmapper: Stop replacing the internal port with the upnp external port This causes the UPnP mapping to break in the next recreation of the mapping. Fixes #18348 Signed-off-by: Eduardo Sorribas <eduardo@sorribas.org>
2026-01-16tsnet: add support for ServicesHarry Harpham8-35/+983
This change allows tsnet nodes to act as Service hosts by adding a new function, tsnet.Server.ListenService. Invoking this function will advertise the node as a host for the Service and create a listener to receive traffic for the Service. Fixes #17697 Fixes tailscale/corp#27200 Signed-off-by: Harry Harpham <harry@tailscale.com>
2026-01-16ipn/ipnlocal: allow retrieval of serve config ETags from local APIHarry Harpham3-36/+48
This change adds API to ipn.LocalBackend to retrieve the ETag when querying for the current serve config. This allows consumers of ipn.LocalBackend.SetServeConfig to utilize the concurrency control offered by ETags. Previous to this change, utilizing serve config ETags required copying the local backend's internal ETag calcuation. The local API server was previously copying the local backend's ETag calculation as described above. With this change, the local API server now uses the new ETag retrieval function instead. Serve config ETags are therefore now opaque to clients, in line with best practices. Fixes tailscale/corp#35857 Signed-off-by: Harry Harpham <harry@tailscale.com>
2026-01-16net/netmon: move TailscaleInterfaceIndex out of netmon.State (#18428)Jonathan Nobels9-60/+184
fixes tailscale/tailscale#18418 Both Serve and PeerAPI broke when we moved the TailscaleInterfaceName into State, which is updated asynchronously and may not be available when we configure the listeners. This extracts the explicit interface name property from netmon.State and adds as a static struct with getters that have proper error handling. The bug is only found in sandboxed Darwin clients, where we need to know the Tailscale interface details in order to set up the listeners correctly (they must bind to our interface explicitly to escape the network sandboxing that is applied by NECP). Currently set only sandboxed macOS and Plan9 set this but it will also be useful on Windows to simplify interface filtering in netns. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2026-01-16docs/windows/policy: use a separate value to track the configuration state ↵Nick Khyl1-1/+1
of EnableDNSRegistration Policy editors, such as gpedit.msc and gpme.msc, rely on both the presence and the value of the registry value to determine whether a policy is enabled. Unless an enabledValue is specified explicitly, it defaults to REG_DWORD 1. Therefore, we cannot rely on the same registry value to track the policy configuration state when it is already used by a policy option, such as a dropdown. Otherwise, while the policy setting will be written and function correctly, it will appear as Not Configured in the policy editor due to the value mismatch (for example, REG_SZ "always" vs REG_DWORD 1). In this PR, we update the DNSRegistration policy setting to use the DNSRegistrationConfigured registry value for tracking. This change has no effect on the client side and exists solely to satisfy ADMX and policy editor requirements. Updates #14917 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2026-01-16k8s-operator,kube: allowing k8s api request events to be enabled via grants ↵Tom Meadows6-50/+118
(#18393) Updates #35796 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
2026-01-15tool/gocross: update gocross-wrapper.ps1 to use absolute path for resolving tarAaron Klotz1-1/+6
gocross-wrapper.ps1 is written to use the version of tar that ships with Windows; we want to avoid conflicts with any other tar on the PATH, such ones installed by MSYS and/or Cygwin. Updates https://github.com/tailscale/corp/issues/29940 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2026-01-14VERSION.txt: this is v1.95.0 (#18414)v1.95.0-preNick O'Neill1-1/+1
Signed-off-by: Nick O'Neill <nick@tailscale.com>
2026-01-14.github/workflows: double the timeout for golangci-lint (#18404)Simon Law1-1/+5
Recently, the golangci-lint workflow has been taking longer and longer to complete, causing it to timeout after the default of 5 minutes. Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: context deadline exceeded Timeout exceeded: try increasing it by passing --timeout option Although PR #18398 enabled the Go module cache, bootstrapping with a cold cache still takes too long. This PR doubles the default 5 minute timeout for golangci-lint to 10 minutes so that golangci-lint can finish downloading all of its dependencies. Note that this doesn’t affect the 5 minute timeout configured in .golangci.yml, since running golangci-lint on your local instance should still be plenty fast. Fixes #18366 Signed-off-by: Simon Law <sfllaw@tailscale.com>
2026-01-14ipn,ipn/local: always accept routes for Tailscale Services (cgnat range) ↵Tom Meadows4-6/+116
(#18173) Updates #18198 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> Co-authored-by: James Tucker <raggi@tailscale.com>
2026-01-14cmd/containerboot: allow for automatic ID token generationMario Minardi4-8/+79
Allow for optionally specifying an audience for containerboot. This is passed to tailscale up to allow for containerboot to use automatic ID token generation for authentication. Updates https://github.com/tailscale/corp/issues/34430 Signed-off-by: Mario Minardi <mario@tailscale.com>
2026-01-14tsnet: allow for automatic ID token generationMario Minardi2-6/+70
Allow for optionally specifiying an audience for tsnet. This is passed to the underlying identity federation logic to allow for tsnet auth to use automatic ID token generation for authentication. Updates https://github.com/tailscale/corp/issues/33316 Signed-off-by: Mario Minardi <mario@tailscale.com>
2026-01-14.github/actions/go-cache: build cigocacher using remote path, fall back to ↵Irbe Krumina2-3/+19
./tool/go (#18409) If local tailscale/tailscale checkout is not available, pulll cigocacher remotely. Fall back to ./tool/go if no other Go installation is present. Updates tailscale/corp#32493 Signed-off-by: Irbe Krumina <irbekrm@gmail.com>
2026-01-14cmd,feature: add identity token auto generation for workload identity (#18373)Danni Popova18-42/+592
Adds the ability to detect what provider the client is running on and tries fetch the ID token to use with Workload Identity. Updates https://github.com/tailscale/corp/issues/33316 Signed-off-by: Danni Popova <danni@tailscale.com>
2026-01-13metrics: add a NewSet and Set.NewLabelMap helpersAnton Tolchanov2-10/+18
Updates tailscale/corp#31174 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2026-01-13metrics: add a NewLabelMap helper to create and register label mapsAnton Tolchanov2-7/+10
Updates tailscale/corp#31174 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2026-01-13.github/workflows: fix timeouts by caching packages for golangci-lint (#18398)Simon Law1-2/+2
Recently, the golangci-lint workflow has been taking longer and longer to complete, causing it to timeout after the default of 5 minutes. Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: context deadline exceeded Timeout exceeded: try increasing it by passing --timeout option This PR upgrades actions/setup-go to version 6, the latest, and enables caching for Go modules and build outputs. This should speed up linting because most packages won’t have to be downloaded over and over again. Fixes #18366 Signed-off-by: Simon Law <sfllaw@tailscale.com>
2026-01-13ipn/store/kubestore: don't load write replica certs in memory (#18395)Irbe Krumina2-9/+9
Fixes a bug where, for kube HA proxies, TLS certs for the replica responsible for cert issuance where loaded in memory on startup, although the in-memory store was not updated after renewal (to avoid failing re-issuance for re-created Ingresses). Now the 'write' replica always reads certs from the kube Secret. Updates tailscale/tailscale#18394 Signed-off-by: Irbe Krumina <irbekrm@gmail.com>
2026-01-12docs: add instructions on referencing pull requests in commit messagesHarry Harpham1-1/+1
Updates #cleanup Signed-off-by: Harry Harpham <harry@tailscale.com>
2026-01-12tsnet: use errors.Join and idiomatic field orderHarry Harpham1-12/+2
Updates #18376 (follow up on feedback) Signed-off-by: Harry Harpham <harry@tailscale.com>
2026-01-09wgengine/magicsock: add home DERP region usermetric (#18062)Raj Singh2-0/+19
Expose the node's home DERP region ID as a Prometheus gauge via the usermetrics endpoint. Fixes #18061 Signed-off-by: Raj Singh <raj@tailscale.com>
2026-01-09go.mod: bump github.com/containerd/containerd@v1.7.29 (#18374)Patrick O'Doherty6-85/+88
Updates #cleanup Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2026-01-09tsnet: ensure funnel listener cleans up after itself when closedHarry Harpham2-0/+143
Previously the funnel listener would leave artifacts in the serve config. This caused weird out-of-sync effects like the admin panel showing that funnel was enabled for a node, but the node rejecting packets because the listener was closed. This change resolves these synchronization issues by ensuring that funnel listeners clean up the serve config when closed. See also: https://github.com/tailscale/tailscale/commit/e109cf9fdd405153a8d8c0ec52a87d7c8ce8689b Updates #cleanup Signed-off-by: Harry Harpham <harry@tailscale.com>
2026-01-09tsnet: reset serve config only onceHarry Harpham1-26/+31
Prior to this change, we were resetting the tsnet's serve config every time tsnet.Server.Up was run. This is important to do on startup, to prevent messy interactions with stale configuration when the code has changed. However, Up is frequently run as a just-in-case step (for example, by Server.ListenTLS/ListenFunnel and possibly by consumers of tsnet). When the serve config is reset on each of these calls to Up, this creates situations in which the serve config disappears unexpectedly. The solution is to reset the serve config only on the first call to Up. Fixes #8800 Updates tailscale/corp#27200 Signed-off-by: Harry Harpham <harry@tailscale.com>
2026-01-09net/udprelay: apply netns Control func to server socket(s)Jordan Whited3-6/+30
To prevent peer relay servers from sending packets *over* Tailscale. Updates tailscale/corp#35651 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2026-01-08cmd,internal,feature: add workload idenity support to gitops pusherMario Minardi3-40/+84
Add support for authenticating the gitops-pusher using workload identity federation. Updates https://github.com/tailscale/corp/issues/34172 Signed-off-by: Mario Minardi <mario@tailscale.com>
2026-01-08feature/featuretags: make QR codes modular (#18358)Simon Law11-37/+103
QR codes are used by `tailscale up --qr` to provide an easy way to open a web-page without transcribing a difficult URI. However, there’s no need for this feature if the client will never be called interactively. So this PR adds the `ts_omit_qrcodes` build tag. Updates #18182 Signed-off-by: Simon Law <sfllaw@tailscale.com>
2026-01-08net/portmapper, go.mod: unfork our goupnp dependencyAndrew Dunham16-100/+134
Updates #7436 Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2026-01-08go.mod: bump mkctr dep (#18365)Tom Proctor5-6/+6
Brings in tailscale/mkctr#29. Updates tailscale/corp#32085 Change-Id: I90160ed1cdc47118ac8fd0712d63a7b590e739d3 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2026-01-08cmd/k8s-operator/e2e,go.mod: remove client v2 dependencyTom Proctor6-37/+53
It's not worth adding the v2 client just for these e2e tests. Remove that dependency for now to keep a clear separation, but we should revive the v2 client version if we ever decide to take that dependency for the tailscale/tailscale repo as a whole. Updates tailscale/corp#32085 Change-Id: Ic51ce233d5f14ce2d25f31a6c4bb9cf545057dd0 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2026-01-08cmd/k8s-operator/e2e: run self-contained e2e tests with devcontrol (#17415)Tom Proctor18-331/+1680
* cmd/k8s-operator/e2e: run self-contained e2e tests with devcontrol Adds orchestration for more of the e2e testing setup requirements to make it easier to run them in CI, but also run them locally in a way that's consistent with CI. Requires running devcontrol, but otherwise supports creating all the scaffolding required to exercise the operator and proxies. Updates tailscale/corp#32085 Change-Id: Ia7bff38af3801fd141ad17452aa5a68b7e724ca6 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com> * cmd/k8s-operator/e2e: being more specific on tmp dir cleanup Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> --------- Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com> Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> Co-authored-by: chaosinthecrd <tom@tmlabs.co.uk>
2026-01-07cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles (#18182)Simon Law6-20/+259
Raw Linux consoles support UTF-8, but we cannot assume that all UTF-8 characters are available. The default Fixed and Terminus fonts don’t contain half-block characters (`▀` and `▄`), but do contain the full-block character (`█`). Sometimes, Linux doesn’t have a framebuffer, so it falls back to VGA. When this happens, the full-block character could be anywhere in extended ASCII block, because we don’t know which code page is active. This PR introduces `--qr-format=auto` which tries to heuristically detect when Tailscale is printing to a raw Linux console, whether UTF-8 is enabled, and which block characters have been mapped in the console font. If Unicode characters are unavailable, the new `--qr-format=ascii` formatter uses `#` characters instead of full-block characters. Fixes #12935 Signed-off-by: Simon Law <sfllaw@tailscale.com>
2026-01-07cmd/containerboot: add OAuth and WIF auth support (#18311)Raj Singh4-10/+131
Fixes tailscale/corp#34430 Signed-off-by: Raj Singh <raj@tailscale.com>
2026-01-07cmd/distsign: add CLI for verifying package signatures (#18239)Andrew Lytvynov2-1/+49
Updates #35374 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2026-01-07ipn,cmd/tailscale/cli: set correct SNI name for TLS-terminated TCP Services ↵Naman Sood3-18/+44
(#17752) Fixes #17749. Signed-off-by: Naman Sood <mail@nsood.in>
2026-01-06wgengine/magicsock: extract IMDS utilities into a standalone package (#18334)Alex Valiushko11-35/+50
Moves magicksock.cloudInfo into util/cloudinfo with minimal changes. Updates #17796 Change-Id: I83f32473b9180074d5cdbf00fa31e5b3f579f189 Signed-off-by: Alex Valiushko <alexvaliushko@tailscale.com>
2026-01-06.github/workflows: bump create-pull-request to 8.0.0Mario Minardi2-2/+2
Bump peter-evans/create-pull-request to 8.0.0 to ensure compatibility with actions/checkout 6.x. Updates #cleanup Signed-off-by: Mario Minardi <mario@tailscale.com>
2026-01-06.github: Bump actions/checkout from 4.2.2 to 5.0.0dependabot[bot]18-35/+35
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 5.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/11bd71901bbe5b1630ceea73d27597364c9af683...08c6903cd8c0fde910a37f88322edcfb5dd907a8) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2026-01-06cmd/tailscale/cli: remove Services-specific subcommands from funnel (#18225)Harry Harpham1-74/+81
The funnel command is sort of an alias for the serve command. This means that the subcommands added to serve to support Services appear as subcommands for funnel as well, despite having no meaning for funnel. This change removes all such Services-specific subcommands from funnel. Fixes tailscale/corp#34167 Signed-off-by: Harry Harpham <harry@tailscale.com>
2026-01-06cmd/tailscaled,ipn/{ipnlocal,store/kubestore}: don't create attestation keys ↵Irbe Krumina4-15/+251
for stores that are not bound to a node (#18322) Ensure that hardware attestation keys are not added to tailscaled state stores that are Kubernetes Secrets or AWS SSM as those Tailscale devices should be able to be recreated on different nodes, for example, when moving Pods between nodes. Updates tailscale/tailscale#18302 Signed-off-by: Irbe Krumina <irbekrm@gmail.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.