LoginSign Up
← Back to all sparks
T

Tailscale

INFRA · APIS
Velocity6.3

Tailnets become API-provisioned resources while Tailscale hardens SSH and thins the control plane.

tailnet-apitailscale-servicesssh-hardeningcli-surfacescaling
◆Current state
Tailscale is in a steady release cadence on the 1.102 line, with the substantive work landing in 1.102.1 and the two releases after it carrying only fixes and library bumps. That release added a Services-oriented CLI surface (tailscale get, whoami, service list), Serve byte metrics for Tailscale Services, and constant-time node addition and removal that cuts CPU on large tailnets. Separately, an alpha tailnet creation API turns tailnets themselves into programmable objects, and the admin console has moved to its own subdomain. A 1.98.10 backport closed two Tailscale SSH vulnerabilities on the older branch.
◆Where it's heading
Two threads are running in parallel. The first is scaling the tailnet as infrastructure: constant-time node churn, an API for creating and deleting tailnets, and a growing CLI vocabulary around Tailscale Services all point at tailnets being provisioned and torn down programmatically rather than administered by hand. The second is tightening the identity edge, with SSH permission checks patched on both the current and previous branches and Funnel certificate renewal moved to TLS-ALPN-01. The version-numbered releases increasingly carry plumbing while the named features carry the direction.
◆Prediction
The tailnet creation API graduating from alpha, with the per-tailnet lifecycle exposed through the same CLI and policy surface as nodes, is the natural next step. Continued Services-related CLI and metrics additions on the 1.102 line look likely given how much of 1.102.1 went that way.

◆Recent moves

  1. 5d ago

    Container image v1.102.2: library updates only

    The container image ships with no changes beyond library updates, alongside a tsrecorder tweak that stops it indexing empty placeholder recordings on startup. Packaging catch-up to the 1.102.2 client release, with nothing user-facing.

  2. 8d ago

    v1.102.2 fixes a Funnel incoming-connection regression

    A single-fix release resolving a regression that broke incoming Tailscale Funnel connections. Fast follow-up to 1.102.1, which is where this cycle's actual feature work landed.

  3. 9d ago

    v1.102.1 adds Services CLI and constant-time node churn

    The substantive release of the cycle: new get, whoami and service list CLI commands, Serve inbound and outbound byte metrics for Tailscale Services, and constant-time node addition and removal that measurably cuts CPU on large tailnets. The scaling fix and the Services CLI vocabulary both feed the same direction of tailnets as managed infrastructure.

  4. 14d ago

    Tailnet creation API

    ⚡ SPARK

    Tailnets stop being org-level constructs an admin sets up once and become objects that can be created and destroyed by API. That is the logical endpoint of the scaling work elsewhere in this window, and it changes who the product is for as much as what it does.

  5. 15d ago

    v1.98.10 backports two Tailscale SSH security fixes

    A backport to the 1.98 branch closing two Tailscale SSH issues: Unix socket forwarding now respects symlink permissions, and additional checks reject UIDs and numeric-only usernames. Maintaining security fixes on the older line signals a meaningful install base that has not moved to 1.102.

  6. 20d ago

    Admin console URL change

    The admin console moves to console.tailscale.com while authentication stays on login.tailscale.com, with the old admin path redirecting. Cosmetic on the surface, but it separates the console from the auth endpoint, which matters to anyone maintaining allowlists.