September 2026 Summaries

Tailscale Kubernetes Operator 1.102 introduces in-cluster Peer Relays, expanded IPv6 support, and certificate-management improvements intended to reduce deployment and connectivity obstacles in Kubernetes environments. The new PeerRelay custom resource lets the operator deploy and maintain relays within clusters, helping multi-cluster workloads establish faster direct connections when VPC or firewall rules would otherwise force traffic through slower DERP relays. The release also enables ProxyGroup Egress to IPv6 destinations, including 4via6 subnet routers that can help connect networks with overlapping IPv4 ranges. To lessen the effects of Let’s Encrypt certificate rate limits, the operator now uses retry backoff and Retry-After headers, longer issuance timeouts, parallel domain issuance, and safeguards against obtaining certificates for services being deleted. Tailscale plans further work on testing, shared Let’s Encrypt account keys, OpenShift and GKE installation, and a redesigned operator architecture using CNI-based routing and workload identities, preceded by pattern-based tag ownership to simplify automated creation of access-control identities.