{"record":{"id":"3ba1da500397bf4b","repo":"tailscale/tailscale","slug":"admission-controller-v-v-not-allowed","errorCode":null,"errorMessage":"admission controller: %v/%v not allowed","messagePattern":"admission controller: (.+?)/(.+?) not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"derp/derpserver/derpserver.go","lineNumber":1656,"sourceCode":"\t\t}\n\t\tres, err := http.DefaultClient.Do(req)\n\t\tif err != nil {\n\t\t\tif s.verifyClientsURLFailOpen {\n\t\t\t\ts.logf(\"admission controller unreachable; allowing client %v\", clientKey)\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn err\n\t\t}\n\t\tdefer res.Body.Close()\n\t\tif res.StatusCode != 200 {\n\t\t\treturn fmt.Errorf(\"admission controller: %v\", res.Status)\n\t\t}\n\t\tvar jres tailcfg.DERPAdmitClientResponse\n\t\tif err := json.NewDecoder(io.LimitReader(res.Body, 4<<10)).Decode(&jres); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif !jres.Allow {\n\t\t\treturn fmt.Errorf(\"admission controller: %v/%v not allowed\", clientKey, clientIP)\n\t\t}\n\t\t// TODO(bradfitz): add policy for configurable bandwidth rate per client?\n\t}\n\treturn nil\n}\n\nfunc (s *Server) sendServerKey(lw *lazyBufioWriter) error {\n\tbuf := make([]byte, 0, len(derp.Magic)+key.NodePublicRawLen)\n\tbuf = append(buf, derp.Magic...)\n\tbuf = s.publicKey.AppendTo(buf)\n\terr := derp.WriteFrame(lw.bw(), derp.FrameServerKey, buf)\n\tlw.Flush() // redundant (no-op) flush to release bufio.Writer\n\treturn err\n}\n\nfunc (s *Server) noteClientActivity(c *sclient) {\n\tif !c.isDup.Load() {\n\t\t// Fast path for clients that aren't in a dup set.","sourceCodeStart":1638,"sourceCodeEnd":1674,"githubUrl":"https://github.com/tailscale/tailscale/blob/a7769cbc33a3eba62bb16fc803b97077c2969d16/derp/derpserver/derpserver.go#L1638-L1674","documentation":"verifyClient: the admission controller responded successfully but its DERPAdmitClientResponse had Allow=false for this client key/IP pair. A policy rejection: the derper refuses to serve this client by design.","triggerScenarios":"Thrown at derp/derpserver/derpserver.go:1637 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Update the admission controller policy to allow this client's node key","Verify the client IP/source presented to the controller matches what policy permits","Have the client re-authenticate or rotate to a node key that policy admits"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a7769cbc33a3eba62bb16fc803b97077c2969d16","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}