LoginSign Up
← Back to all sparks
T

Tailscale

INFRA · APIS
Velocity5.0

Tailscale ships a client patch to distrust compromised TLS intermediates as policy features land.

zero trust networkingpolicy as codesecuritylarge tailnetsdevice posture
◆Current state
Tailscale is moving tailnet administration into policy and automation: MagicRoute route selection, declarative node sharing, self-serve identity provider changes and posture alerts all landed in October. The 1.104 client line underneath is getting efficiency and reliability work. The newest patch, v1.104.2, is a security update.
◆Where it's heading
The month's product releases share one theme: things admins used to click through, such as routing, sharing, IdP and posture, become declarative and auditable. The client releases support that by hardening large-tailnet behavior. The security patch shows that supply-chain trust is now part of the client release cadence.
◆Prediction
Expect MagicRoute and declarative sharing to move from beta and alpha toward GA, with more 1.104.x patches for Windows and large tailnets in the meantime.

◆Recent moves

  1. 2d ago

    Device Provisioning with OAuth Apps

    OAuth Apps for device provisioning are now generally available through the Tailscale API, so fleets can enroll devices with scoped app credentials instead of reusable auth keys. It sits with the month's admin and policy work on identity and fleet management.

  2. 8d ago

    v1.104.2 distrusts compromised TLS intermediates, fixes Windows DNS

    v1.104.2 moves to Go 1.27.3 so the client explicitly distrusts compromised TLS intermediate certificates under bulletin TS-2026-013. It also fixes Windows disconnects on large tailnets and a regression that routed all DNS through MagicDNS. Admins should prioritize this update.

  3. 10d ago

    MagicRoute

    MagicRoute (beta) makes route selection across redundant subnet routers, app connectors, exit nodes and Service hosts a configurable policy, replacing the old Regional Routing toggle. It fits the month's pattern of turning implicit network behavior into explicit admin controls.

  4. 15d ago

    Self-serve identity provider changes GA

    Owners can now switch the tailnet's identity provider from the admin console, now generally available for supported providers. It removes a support-ticket step and continues the move toward self-serve administration.

  5. 16d ago

    Kubernetes Operator 1.104.1 fixes cert limits, PeerRelay reach

    The container image is a library bump, but the matching Kubernetes operator release does real work: a shared Let's Encrypt account key per tailnet keeps Ingress renewals out of rate limits, PeerRelay accepts custom UDP ports, and egress ProxyGroup rollouts wait for each pod to route before moving on. It is the operator side of the same 1.104 reliability push the client got a week earlier.

  6. 21d ago

    Device Posture Monitoring and Alerts

    Posture failures now raise alerts, show badges and a filter on the Machines page, and can display a custom message on macOS, iOS and Android clients and in tailscale status (beta). Two weeks after admins could see why a device fails posture, end users can now see it too, which turns posture from a silent block into something support can diagnose.