{"record":{"id":"8e0561b812f0ad03","repo":"tailscale/tailscale","slug":"failed-to-delete-s-q-w","errorCode":null,"errorMessage":"failed to delete %s %q: %w","messagePattern":"failed to delete (.+?) %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go","lineNumber":116,"sourceCode":"\t\t\t\tName: egress,\n\t\t\t},\n\t\t},\n\t\t&admr.ValidatingAdmissionPolicyBinding{\n\t\t\tObjectMeta: metav1.ObjectMeta{\n\t\t\t\tName: egress,\n\t\t\t},\n\t\t},\n\t}\n\n\tfor _, obj := range objects {\n\t\terr := r.Delete(ctx, obj)\n\t\tswitch {\n\t\tcase apierrors.IsNotFound(err):\n\t\t\t// A resource may have already been deleted in a previous reconciliation that failed for\n\t\t\t// some reason, so we'll ignore it if it doesn't exist.\n\t\t\tcontinue\n\t\tcase err != nil:\n\t\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to delete %s %q: %w\", obj.GetObjectKind().GroupVersionKind().Kind, obj.GetName(), err)\n\t\t}\n\t}\n\n\treturn reconcile.Result{}, nil\n}\n\nfunc (r *Reconciler) createOrUpdate(ctx context.Context, namespace string, policies tsapi.ProxyGroupPolicyList) (reconcile.Result, error) {\n\tingressNames := set.Set[string]{}\n\tegressNames := set.Set[string]{}\n\n\t// If this namespace has multiple ProxyGroupPolicy resources, we'll reduce them down to just their distinct\n\t// egress/ingress names.\n\tfor _, policy := range policies.Items {\n\t\tingressNames.AddSlice(policy.Spec.Ingress)\n\t\tegressNames.AddSlice(policy.Spec.Egress)\n\t}\n\n\tingress, err := r.generateIngressPolicy(ctx, namespace, ingressNames)","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/tailscale/tailscale/blob/0fd2f14deb478d09c95f38af2b0d35b492b63520/k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go#L98-L134","documentation":"ProxyGroupPolicy cleanup path: deleting a generated ValidatingAdmissionPolicy (or its binding) failed with a non-NotFound error. NotFound is deliberately ignored (already gone); any other API-server error is wrapped and returned so reconcile retries.","triggerScenarios":"Thrown at k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go:116 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check operator RBAC delete permissions and that the resource exists."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0fd2f14deb478d09c95f38af2b0d35b492b63520","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}