feat(helm): update chart tailscale-operator ( 1.62.0 → 1.78.3 )

[renovate]

This PR contains the following updates:

Package	Update	Change
tailscale-operator	minor	1.62.0 -> 1.78.3

---

Release Notes

tailscale/tailscale (tailscale-operator)

v1.78.3

Compare Source

v1.78.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.76.6

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.76.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.74.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.72.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog#2024-08-22.

v1.72.0

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog#2024-08-19.

v1.70.0

Compare Source

All platforms

• New: Restrict recommended and automatically selected exit nodes using the new AllowedSuggestedExitNodes system policy. Applies only to platforms that support system policies.
• Changed: Improved NAT traversal for some uncommon scenarios.
• Changed: Optimized sending firewall rules to clients more efficiently.
• Fixed: Exit node suggestion CLI command now prints the hostname (which you can use with the tailscale set command).
• Fixed: Taildrive share paths configured through the CLI resolve relative to where you run the tailscale command.

Linux

• Fixed: Switching from unstable to stable tracks using the tailscale update command now works correctly.

Windows

• New: Use the value auto:any to automatically select an exit node for the existing ExitNodeID system policy. Available for Enterprise plan users only.
• New: The new AllowedSuggestedExitNodes system policy restricts which exit nodes Tailscale recommends or automatically selects.
• Fixed: DNS leak issue.
• Fixed: Switching from unstable to stable tracks using the tailscale update command now works correctly.
• Fixed: Taildrive server no longer starts unnecessarily when no drives are configured.

macOS

Note: As previously announced, Tailscale v1.70 is the last version to support macOS 10.15 Catalina. macOS 10.15 is no longer supported by Apple and no longer receives security updates. Users still running macOS 10.15 should update to a newer version of macOS to continue receiving security updates and new features.

• New: Toggle Tailscale DNS from Siri or the Shortcuts app.
• New: Receive health notifications in the client menu on macOS to inform you about lack of internet connectivity, firewalls blocking Tailscale, misconfiguration issues, and other issues. Health issues that affect connectivity also change the Tailscale icon in the system menubar to show an exclamation mark.
• New: On MacBooks with a notch in the display, a notification window will now appear if the Tailscale icon is hidden behind the notch due to too many menubar items.
• New: The Tailscale client now warns you when the built-in macOS content filter (Screen Time) prevents Tailscale from connecting.
• New: Use the value auto:any to automatically select an exit node for the existing ExitNodeID system policy. Available for Enterprise plan users only.
• Changed: The exit node picker no longer presents exit node suggestions if the organization enforces always using the suggested exit node using the ExitNodeID system policy.
• Fixed: Disconnect shortcut no longer connects to the VPN tunnel if executed when Tailscale is disconnected.
• Fixed: Taildrive server no longer starts unnecessarily when no drives are configured.
• Fixed: Increased the reliability of the Install Updates Automatically setting.

iOS

• New: Toggle Tailscale DNS from Siri or the Shortcuts app.
• New: Use the value auto:any to automatically select an exit node for the existing ExitNodeID system policy. Available for Enterprise plan users only.
• Fixed: wireguard-go memory pool deadlock issue is resolved.
• Fixed: Disconnect shortcut no longer connects to the VPN tunnel if executed when Tailscale is disconnected.
• Fixed: User interface no longer flickers when selecting an exit node.

tvOS

• New: Use the value auto:any to automatically select an exit node for the existing ExitNodeID system policy. Available for Enterprise plan users only.
• Fixed: wireguard-go memory pool deadlock issue is resolved.
• Fixed: User interface no longer flickers when selecting an exit node.

Android

• New: Access ping information and connection status by long-pressing on a device in the devices list and selecting Ping.
• New: Use split tunneling to force or exclude app traffic through your tailnet.
• Fixed: wireguard-go memory pool deadlock issue is resolved.

v1.68.1

Compare Source

All Platforms

• Fixed: 4via6 subnet router advertisement works as expected.

Linux

• Fixed: Tailscale SSH access to Security-Enhanced Linux (SELinux) machines works as expected.

v1.66.4

Compare Source

All platforms

• Fixed: Restored UDP connectivity through Mullvad exit nodes.

Linux

• Changed: Stateful filtering is now off by default. Stateful filtering was introduced in 1.66.0 as a mitigation for a vulnerability described in TS-2024-005, and inadvertently broke DNS resolution from containers running on the host. Most vulnerable setups are protected by other mitigations already, except when autogroup:danger-all is used in ACLs.

v1.66.3

Compare Source

All platforms

• Fixed: Login URLs did not always appear in the console when running tailscale up.

Android

• Changed: Reintroduced the Quick Settings title that v1.66.0 temporarily removed.
• Changed: Improved the VPN service connection logic, especially when rebooting the device with Always-On VPN enabled.
• Changed: The persistent VPN status notification now informs the user with a muted icon when the VPN is disconnected. VPN status notifications can be disabled in the system notification settings.
• Fixed: The "Enable" button in the exit node selector banner now renders with the correct background color.

Kubernetes operator

• Breaking change: Starting with v1.66, the Kubernetes operator must always run the same or later version as the proxies it manages.
• New: Expose cloud services on cluster network to the tailnet, using Kubernetes ExternalName Services. This allows exposing cloud services, such as RDS instances, to tailnet by their DNS names.
• New: Expose tailnet services that use Tailscale HTTPS to cluster workloads. Refer to #​11019.
• New: Cluster workloads can now refer to Tailscale Ingress resources by their MagicDNS names. Refer to #​11019.
• New: Configure environment variables for Tailscale Kubernetes operator proxies using ProxyClass CRD.
  Refer to ProxyClass API.
• New: Expose tailscaled metrics endpoint for Tailscale Kubernetes operator proxies through ProxyClass CRD. Note that the tailscaled metrics are unstable and will likely change in the future. Refer to ProxyClass API.
• New: Configure labels for the Kubernetes operator Pods with Helm chart values. Refer to Helm chart values.
• New: Configure affinity rules for Kubernetes operator proxy Pods with ProxyClass. Refer to ProxyClass API.
• Fixed: Kubernetes operator proxy init container no longer attempts to enable IPv6 forwarding on systems that don't have IPv6 module loaded. Refer to #​11867.

Containers

• Fixed: Tailscale containers running on Kubernetes no longer error if an empty Kubernetes Secret is pre-created for the tailscaled state. Refer to #​11326.
• Fixed: Improved the ambiguous error messages when Tailscale running on Kubernetes does not have the right permissions to perform actions against the tailscaled state Secret. Refer to #​11326.

v1.64.2

Compare Source

Windows

• Changed: Installers are now built using WiX toolchain version 3.14.1.

Synology

• Fixed: DiskStation Manager UI no longer freezes for a few minutes at startup when attempting to clean unused routes. This update is applicable to the version provided on pkgs.tailscale.com[^1].

[^1]: We initially noted this as being released in 1.64.1, but that package was not uploaded incorrectly, so 1.64.2 has the actual fix.

v1.64.1

Compare Source

Synology

• Fixed: No longer freezes for a few minutes at startup when attempting to clean unused routes

v1.64.0

Compare Source

All platforms

• Changed: tailscale serve headers are now RFC 2047 Q-encoded

macOS

• New: Access a new Internet Access Policy for Little Snitch users
• New: Receive alerts when an error occurs while changing client preferences
• New: Use Tailscale for macOS as a Tailscale SSH client (Standalone variant only)
• New: tailscale ssh and tailscale nc are now supported in the Standalone variant of the client.
• Changed: The .pkg installer no longer requires a system restart after installing the client (Standalone variant only)
• Fixed: Reduced number of alerts if the network extension terminates unexpectedly
• Fixed: Unexpected terminations for some macOS 10.15 Catalina users

iOS

• Fixed: Improved reliability of the ping chart presentation

Synology

• New: Update certificates using the configure synology-cert CLI command
• Fixed: IPv6 addresses are available again

Kubernetes operator

• New: tailscale configure kubeconfig now respects KUBECONFIG environment variable.
• Fixed: tailscale configure kubeconfig now works with partially empty kubeconfig.
• Fixed: MSS clamping for Kubernetes operator proxies using nftables.

Containers

• Fixed: Containers on hosts with partial support for ip6tables no longer crash.

v1.62.1

Compare Source

Linux

New: Send load balancing hint HTTP request header

Windows

Fixed: Do not allow msiexec to reboot the operating system

macOS

Issue that could cause the Tailscale system extension to not be installed upon app launch, when deploying Tailscale using MDM and using a configuration profile to pre-approve the VPN tunnel (applies to standalone variant only)

Synology

Fixed: IPv6 routing

Kubernetes operator

Fixed: Kubernetes operator proxies should not accept subnet routes

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[carpenike-bot]

🦙 MegaLinter status: ❌ ERROR

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
❌ COPYPASTE	jscpd	yes		2	1.08s
✅ REPOSITORY	git_diff	yes		no	0.04s
✅ REPOSITORY	secretlint	yes		no	3.19s
✅ YAML	prettier	1		0	0.37s
✅ YAML	yamllint	1		0	0.33s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by

[carpenike-bot]

--- kubernetes/cluster-0/apps/tailscale/tailscale-operator/app Kustomization: flux-system/tailscale-operator HelmRelease: tailscale/tailscale-operator

+++ kubernetes/cluster-0/apps/tailscale/tailscale-operator/app Kustomization: flux-system/tailscale-operator HelmRelease: tailscale/tailscale-operator

@@ -14,13 +14,13 @@

       chart: tailscale-operator
       interval: 30m
       sourceRef:
         kind: HelmRepository
         name: tailscale
         namespace: flux-system
-      version: 1.62.0
+      version: 1.78.3
   interval: 30m
   values:
     apiServerProxyConfig:
       mode: 'true'
     operatorConfig:
       hostname: tailscale-operator

[carpenike-bot]

--- HelmRelease: tailscale/tailscale-operator ClusterRole: tailscale/tailscale-operator

+++ HelmRelease: tailscale/tailscale-operator ClusterRole: tailscale/tailscale-operator

@@ -8,20 +8,34 @@

   - ''
   resources:
   - events
   - services
   - services/status
   verbs:
-  - '*'
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - networking.k8s.io
   resources:
   - ingresses
   - ingresses/status
   verbs:
-  - '*'
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - networking.k8s.io
   resources:
   - ingressclasses
   verbs:
   - get
@@ -31,12 +45,44 @@

   - tailscale.com
   resources:
   - connectors
   - connectors/status
   - proxyclasses
   - proxyclasses/status
+  - proxygroups
+  - proxygroups/status
   verbs:
   - get
   - list
   - watch
   - update
+- apiGroups:
+  - tailscale.com
+  resources:
+  - dnsconfigs
+  - dnsconfigs/status
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+- apiGroups:
+  - tailscale.com
+  resources:
+  - recorders
+  - recorders/status
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+  resourceNames:
+  - servicemonitors.monitoring.coreos.com
 
--- HelmRelease: tailscale/tailscale-operator Role: tailscale/operator

+++ HelmRelease: tailscale/tailscale-operator Role: tailscale/operator

@@ -6,15 +6,73 @@

   namespace: tailscale
 rules:
 - apiGroups:
   - ''
   resources:
   - secrets
+  - serviceaccounts
+  - configmaps
   verbs:
-  - '*'
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - apps
   resources:
   - statefulsets
+  - deployments
   verbs:
-  - '*'
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - deletecollection
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - roles
+  - rolebindings
+  verbs:
+  - get
+  - create
+  - patch
+  - update
+  - list
+  - watch
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - servicemonitors
+  verbs:
+  - get
+  - list
+  - update
+  - create
+  - delete
 
--- HelmRelease: tailscale/tailscale-operator Role: tailscale/proxies

+++ HelmRelease: tailscale/tailscale-operator Role: tailscale/proxies

@@ -7,8 +7,23 @@

 rules:
 - apiGroups:
   - ''
   resources:
   - secrets
   verbs:
-  - '*'
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - get
 
--- HelmRelease: tailscale/tailscale-operator Deployment: tailscale/operator

+++ HelmRelease: tailscale/tailscale-operator Deployment: tailscale/operator

@@ -20,13 +20,13 @@

       volumes:
       - name: oauth
         secret:
           secretName: operator-oauth
       containers:
       - name: operator
-        image: tailscale/k8s-operator:v1.62.0
+        image: tailscale/k8s-operator:v1.78.3
         imagePullPolicy: Always
         env:
         - name: OPERATOR_INITIAL_TAGS
           value: tag:k8s-operator
         - name: OPERATOR_HOSTNAME
           value: tailscale-operator
@@ -40,19 +40,27 @@

               fieldPath: metadata.namespace
         - name: CLIENT_ID_FILE
           value: /oauth/client_id
         - name: CLIENT_SECRET_FILE
           value: /oauth/client_secret
         - name: PROXY_IMAGE
-          value: tailscale/tailscale:v1.62.0
+          value: tailscale/tailscale:v1.78.3
         - name: PROXY_TAGS
           value: tag:k8s
         - name: APISERVER_PROXY
           value: 'true'
         - name: PROXY_FIREWALL_MODE
           value: auto
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_UID
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.uid
         volumeMounts:
         - name: oauth
           mountPath: /oauth
           readOnly: true
       nodeSelector:
         kubernetes.io/os: linux