{"record":{"id":"59bc54c298fc88ed","repo":"tailscale/tailscale","slug":"failed-to-generate-ingress-policy-w","errorCode":null,"errorMessage":"failed to generate ingress policy: %w","messagePattern":"failed to generate ingress policy: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go","lineNumber":136,"sourceCode":"\t}\n\n\treturn reconcile.Result{}, nil\n}\n\nfunc (r *Reconciler) createOrUpdate(ctx context.Context, namespace string, policies tsapi.ProxyGroupPolicyList) (reconcile.Result, error) {\n\tingressNames := set.Set[string]{}\n\tegressNames := set.Set[string]{}\n\n\t// If this namespace has multiple ProxyGroupPolicy resources, we'll reduce them down to just their distinct\n\t// egress/ingress names.\n\tfor _, policy := range policies.Items {\n\t\tingressNames.AddSlice(policy.Spec.Ingress)\n\t\tegressNames.AddSlice(policy.Spec.Egress)\n\t}\n\n\tingress, err := r.generateIngressPolicy(ctx, namespace, ingressNames)\n\tif err != nil {\n\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to generate ingress policy: %w\", err)\n\t}\n\n\tingressBinding, err := r.generatePolicyBinding(ctx, namespace, ingress)\n\tif err != nil {\n\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to generate ingress policy binding: %w\", err)\n\t}\n\n\tegress, err := r.generateEgressPolicy(ctx, namespace, egressNames)\n\tif err != nil {\n\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to generate egress policy: %w\", err)\n\t}\n\n\tegressBinding, err := r.generatePolicyBinding(ctx, namespace, egress)\n\tif err != nil {\n\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to generate egress policy binding: %w\", err)\n\t}\n\n\tobjects := []client.Object{","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/tailscale/tailscale/blob/0fd2f14deb478d09c95f38af2b0d35b492b63520/k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go#L118-L154","documentation":"createOrUpdate: generateIngressPolicy failed while building or fetching the ingress ValidatingAdmissionPolicy for the namespace. The wrapped error comes from policy generation/Get; the whole reconciliation is aborted and retried.","triggerScenarios":"Thrown at k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go:136 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the ProxyGroup ingress spec for invalid values; see logs for the wrapped error."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0fd2f14deb478d09c95f38af2b0d35b492b63520","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}