tailscale / tailscale/tailscale

Services: daemon doesn't pick up host approval without re-advertise + delay

Open
#18,821 1 comment 2 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
36.5k
Forks
3.2k
Avg merge
2d 3h
Merged PRs (30d)
123

Description

### What is the issue?

After a service host is approved (via the API or admin console), the local Tailscale daemon does not automatically pick up the new approval status. Running `tailscale serve --service=svc:name ...` continues to report "approval from an admin is required" until the service is cleared and re-advertised.

Additionally, when clearing and immediately re-advertising, there appears to be a timing issue where the daemon doesn't pick up the approval status if the commands are run in quick succession. Adding a short delay (~2 seconds) between `tailscale serve clear` and `tailscale serve --service=...` resolves this.

### Steps to reproduce

```bash
# 1. Define a service (via admin console or API) and advertise it
tailscale serve --service=svc:test --https=443 127.0.0.1:8080
# Output: "approval from an admin is required"

# 2. Approve the host (via admin console or API)
curl -X POST -H "Authorization: Bearer $KEY" \
-H "Content-Type: application/json" \
-d '{"approved": true}' \
"https://api.tailscale.com/api/v2/tailnet/$TAILNET/services/svc:test/device/$NODE_ID/approved"
# Returns: {"approved": true, "autoApproved": false}

# 3. Clear and re-advertise immediately — may still report approval required
tailscale serve clear svc:test && tailscale serve --service=svc:test --https=443 127.0.0.1:8080
# Output: "approval from an admin is required" (sometimes)

# 4. Clear and re-advertise with delay — works reliably
tailscale serve clear svc:test && sleep 2 && tailscale serve --service=svc:test --https=443 127.0.0.1:8080
# Output: "Available within your tailnet"
```

### Expected behaviour

Ideally the daemon should detect approval status changes automatically without requiring a clear + re-advertise cycle. Failing that, `tailscale serve clear && tailscale serve --service=...` should work without needing a delay.

### Are there any recent changes that introduced the issue?

Tailscale Services (beta October 2025, GA February 2026)

### OS

Linux

### OS version

QTS 5.2.6 (QNAP TS-453be, kernel 5.10.60)

### Tailscale version

1.94.2

### Other software

N/A

### Bug report

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.