{"record":{"id":"6512700d9a1b6480","repo":"tailscale/tailscale","slug":"failed-to-generate-egress-policy-w","errorCode":null,"errorMessage":"failed to generate egress policy: %w","messagePattern":"failed to generate egress policy: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go","lineNumber":146,"sourceCode":"\t// egress/ingress names.\n\tfor _, policy := range policies.Items {\n\t\tingressNames.AddSlice(policy.Spec.Ingress)\n\t\tegressNames.AddSlice(policy.Spec.Egress)\n\t}\n\n\tingress, err := r.generateIngressPolicy(ctx, namespace, ingressNames)\n\tif err != nil {\n\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to generate ingress policy: %w\", err)\n\t}\n\n\tingressBinding, err := r.generatePolicyBinding(ctx, namespace, ingress)\n\tif err != nil {\n\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to generate ingress policy binding: %w\", err)\n\t}\n\n\tegress, err := r.generateEgressPolicy(ctx, namespace, egressNames)\n\tif err != nil {\n\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to generate egress policy: %w\", err)\n\t}\n\n\tegressBinding, err := r.generatePolicyBinding(ctx, namespace, egress)\n\tif err != nil {\n\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to generate egress policy binding: %w\", err)\n\t}\n\n\tobjects := []client.Object{\n\t\tingress,\n\t\tingressBinding,\n\t\tegress,\n\t\tegressBinding,\n\t}\n\n\tfor _, obj := range objects {\n\t\t// Attempt to perform an update first as we'll only create these once and continually update them, so it's\n\t\t// more likely that an update is needed instead of creation. If the resource does not exist, we'll\n\t\t// create it.","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/tailscale/tailscale/blob/0fd2f14deb478d09c95f38af2b0d35b492b63520/k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go#L128-L164","documentation":"Reconciliation failed while generating the egress ValidatingAdmissionPolicy for the namespace's distinct egress ProxyGroup names. The wrapped error is from the Kubernetes API. The reconcile result is returned as an error so controller-runtime requeues.","triggerScenarios":"Thrown at k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go:146 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the ProxyGroup custom resource spec for invalid or incomplete egress configuration (missing ports, CIDRs, or service references).","Inspect the wrapped error for the underlying validation failure and fix the referenced field in the ProxyGroup spec.","Ensure the operator's RBAC and dependencies required to build the egress policy are present in the cluster."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0fd2f14deb478d09c95f38af2b0d35b492b63520","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}