{"record":{"id":"66017a1768ed6da6","repo":"tailscale/tailscale","slug":"error-loading-state-from-kube-secret-w","errorCode":null,"errorMessage":"error loading state from kube Secret: %w","messagePattern":"error loading state from kube Secret: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ipn/store/kubestore/store_kube.go","lineNumber":146,"sourceCode":"\t\ts.certShareMode = \"rw\"\n\t} else if envknob.IsCertShareReadOnlyMode() {\n\t\ts.certShareMode = \"ro\"\n\t}\n\n\t// Configure shared ACME account lookup. Only meaningful for the cert\n\t// issuer (cert share \"rw\") — read replicas never issue.\n\tif s.certShareMode == \"rw\" {\n\t\ts.acmeAccountsSecretName = os.Getenv(\"TS_ACME_ACCOUNT_SECRET_NAME\")\n\t\ts.acmeAccountField = os.Getenv(\"TS_ACME_ACCOUNT_FIELD\")\n\t\tif s.acmeAccountsSecretName != \"\" && s.acmeAccountField == \"\" {\n\t\t\ts.logf(\"[unexpected] TS_ACME_ACCOUNT_SECRET_NAME set without TS_ACME_ACCOUNT_FIELD; ignoring shared ACME account configuration\")\n\t\t\ts.acmeAccountsSecretName = \"\"\n\t\t}\n\t}\n\n\t// Load latest state from kube Secret if it already exists.\n\tif err := s.loadState(); err != nil && err != ipn.ErrStateNotExist {\n\t\treturn nil, fmt.Errorf(\"error loading state from kube Secret: %w\", err)\n\t}\n\t// If we are in read-only cert share mode, pre-load existing shared certs.\n\t// Write replicas never load certs in-memory to avoid a situation where,\n\t// after Ingress recreation (and the associated cert Secret recreation), new\n\t// TLS certs don't get issued because the write replica still has certs\n\t// in-memory. Instead, write replicas fetch certs from Secret on each request.\n\tif s.certShareMode == \"ro\" {\n\t\tsel := s.certSecretSelector()\n\t\tif err := s.loadCerts(context.Background(), sel); err != nil {\n\t\t\t// We will attempt to again retrieve the certs from Secrets when a request for an HTTPS endpoint\n\t\t\t// is received.\n\t\t\ts.logf(\"[unexpected] error loading TLS certs: %v\", err)\n\t\t}\n\t}\n\tif s.certShareMode == \"ro\" {\n\t\tgo s.runCertReload(context.Background())\n\t}\n\tif s.acmeAccountsSecretName != \"\" {","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/ipn/store/kubestore/store_kube.go#L128-L164","documentation":"Reading the operator's state Secret from the Kubernetes API failed during kubestore construction (with NotFound already mapped to a fresh store), so persistent tailscale state could not be loaded and the store cannot start.","triggerScenarios":"Thrown at ipn/store/kubestore/store_kube.go:146 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Loading state from the Kubernetes Secret failed; verify the Secret exists, the pod's service account has get permission on it, and the stored data is valid."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}