December 2022 Summaries

Tailscale's December newsletter highlights significant achievements and updates from 2022, including the launch of Tailscale SSH, which facilitates seamless SSH access to devices on a tailnet without additional setup, and the integration of on-demand access with partners to streamline user provisioning. The company secured SOC 2 compliance, emphasizing its dedication to security, and announced a $100 million Series B funding round led by CRV and Insight Partners. The newsletter also showcases community contributions, such as innovative uses of Tailscale for remote server management, integration with OBS for live news broadcasting, and secure access to Synology NAS devices. Tailscale engineers have improved wireguard-go's throughput on Linux, enhancing client performance, and introduced Tailnet lock for added security. The company is expanding its team and building a learning library to support career development, while also engaging with users at events like AWS re:Invent 2022.

User and group provisioning for Okta has become generally available, allowing administrators to streamline the onboarding and offboarding processes by syncing directly with the identity provider. This feature enables automatic synchronization of group memberships and deactivated users, allowing predefined groups in Okta to be pushed to Tailscale with updates to group names and users reflected automatically. By integrating Okta's groups into access rules within the tailnet policy file, organizations can maintain up-to-date permissions without manual intervention, addressing significant operational challenges when employees are hired, change teams, or exit. This advancement simplifies user and device management and reduces the administrative burden associated with updating permissions manually.

Tailscale, in collaboration with Pulumi, offers an innovative solution called Connecti for quickly accessing private subnets in cloud environments. This command-line tool, developed using Pulumi’s automation API and written in Go, allows users to provision Tailscale subnet routers in seconds without the need for infrastructure code, facilitating temporary VPN connections for debugging and accessing sensitive services. Pulumi is an open-source infrastructure as code platform that supports traditional and modern cloud architectures, and Connecti integrates seamlessly with AWS, Azure, Google Cloud, Kubernetes, and plans to expand to other providers. By allowing quick and efficient connection setups, Connecti addresses common networking challenges, such as accessing private databases or servers, without the complexity of traditional methods like bastion hosts or custom TLS certificates. It supports Pulumi's self-managed backends and offers audit logs through Pulumi’s console, making it a versatile tool for DevOps teams needing quick access to isolated networks.

Crunchy Bridge has announced its integration with Tailscale to facilitate secure and convenient access to PostgreSQL databases from any device. As a managed Postgres service, Crunchy Bridge offers database management and scalability on a preferred cloud platform while ensuring data security by minimizing exposure to the public internet. This integration allows users to generate an authentication key via the Tailscale admin console, which is then added to Crunchy Bridge's cluster settings, enabling the database to appear on a private tailnet for broader accessibility. Furthermore, Tailscale's network access control features allow precise regulation of who can access the database, making it a versatile solution for multi-cloud environments, cloud migrations, and developer infrastructure.

Tailscale introduces "tailnet lock," a new security feature designed to enhance trust and security in its network management service by allowing users to verify public keys distributed by Tailscale's coordination server. This feature aims to eliminate the need for users to trust Tailscale's coordination server entirely, as it introduces a system where nodes must be endorsed by cryptographic signatures from trusted tailnet lock keys before they can connect to other nodes. This endorsement mechanism helps prevent unauthorized or malicious nodes from joining a network, even if the coordination server were compromised. The implementation involves a tailnet key authority to manage trusted tailnet lock keys, and it requires users to set up disablement secrets for emergency situations. Tailnet lock is currently in an alpha phase, accessible to select users, and Tailscale plans to improve the user experience by addressing certain limitations and expanding availability.

Significant improvements were made to the userspace implementation of WireGuard, specifically wireguard-go, which Tailscale uses, resulting in enhanced performance for the Tailscale client on Linux. These enhancements, which are planned to be integrated into WireGuard, showcase a notable improvement in throughput by employing techniques such as TCP segmentation offload (TSO), generic receive offload (GRO), and the use of sendmmsg() and recvmmsg() system calls. The changes led to a 2.2x improvement in wireguard-go's performance and up to a 33% increase in Tailscale's throughput on Linux. The performance gains were achieved by reducing per-packet overhead through increased MTU settings and leveraging existing kernel interfaces, demonstrating that userspace can match or even exceed kernel-level performance when optimized with the right techniques.

Tailscale's v1.34 update introduces fast user switching, allowing users to seamlessly switch between different Tailscale accounts on the same device without the need for re-authentication, enhancing convenience for those using Tailscale in both personal and professional contexts. This feature is available in alpha on Linux, macOS, and Windows, with support for additional platforms planned for the future. Users can switch accounts by selecting them from the menu on macOS or using terminal commands, and they can assign nicknames to accounts for even easier switching. Fast user switching ensures that each identity remains separate, with no communication between different tailnets, though re-authentication is required if the device's node key expires.