{"record":{"id":"8eeb375ad9ac81df","repo":"tailscale/tailscale","slug":"ingress-proxy-error-retrieving-current-status-w","errorCode":null,"errorMessage":"ingress proxy: error retrieving current status: %w","messagePattern":"ingress proxy: error retrieving current status: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/containerboot/ingressservices.go","lineNumber":99,"sourceCode":"\t\t}\n\t}\n}\n\n// sync reconciles proxy's firewall rules (iptables or nftables) on ingress config changes:\n// - ensures that new firewall rules are added\n// - ensures that old firewall rules are deleted\n// - updates ingress proxy's status in the state Secret\nfunc (p *ingressProxy) sync(ctx context.Context) error {\n\t// 1. Get the desired firewall configuration\n\tcfgs, err := p.getConfigs()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"ingress proxy: error retrieving configs: %w\", err)\n\t}\n\n\t// 2. Get the recorded firewall status\n\tstatus, err := p.getStatus(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"ingress proxy: error retrieving current status: %w\", err)\n\t}\n\n\t// 3. Ensure that firewall configuration is up to date\n\tif err := p.syncIngressConfigs(cfgs, status); err != nil {\n\t\treturn fmt.Errorf(\"ingress proxy: error syncing configs: %w\", err)\n\t}\n\tvar existingConfigs *ingressservices.Configs\n\tif status != nil {\n\t\texistingConfigs = &status.Configs\n\t}\n\n\t// 4. Update the recorded firewall status\n\tif !(ingressServicesStatusIsEqual(cfgs, existingConfigs) && p.isCurrentStatus(status)) {\n\t\tif err := p.recordStatus(ctx, cfgs); err != nil {\n\t\t\treturn fmt.Errorf(\"ingress proxy: error setting status: %w\", err)\n\t\t}\n\t}\n\treturn nil","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/tailscale/tailscale/blob/cfe32b8be6a33f8e24fbc369cbfbf7c729d9e042/cmd/containerboot/ingressservices.go#L81-L117","documentation":"Thrown by ingressProxy.sync when p.getStatus fails. getStatus fetches the proxy's state Secret via the Kubernetes API (kc.GetSecret) and unmarshals the ingress config key from its data; it returns nil,nil when the key is absent, so an error means either the Secret GET failed (connectivity, RBAC, API errors) or the stored status JSON is corrupt.","triggerScenarios":"API server unreachable or returning errors when the proxy syncs; the proxy's service account lacks get on the state Secret; the state Secret was deleted; a previous writer stored malformed JSON under the ingress config key, failing the unmarshal.","commonSituations":"Operator ingress proxies during API server outages or node networking issues; RBAC trimmed after the proxy was created; state Secrets hand-edited or partially migrated between operator versions.","solutions":["Verify the proxy's service account can get the state Secret (kubectl auth can-i get secret/<name> -n <ns>)","Check API server connectivity from the pod and kube-apiserver health","If the stored status JSON is corrupt, clear the ingress config key in the state Secret so getStatus returns nil and rules are rebuilt from the config file","For transient API errors, allow the pod restart to retry once connectivity returns"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight: confirm the proxy can read its state Secret\n// kubectl auth can-i get secret/<state-secret> --as=system:serviceaccount:<ns>:<sa>","typeGuard":null,"tryCatchPattern":"status, err := p.getStatus(ctx)\nif err != nil {\n    if kubeclient.IsRetryable(err) || errors.Is(err, context.DeadlineExceeded) { // transport/timeout: retry with backoff\n        status, err = p.getStatus(ctx)\n    }\n    if err != nil {\n        return fmt.Errorf(\"ingress proxy: error retrieving current status: %w\", err)\n    }\n}","preventionTips":["Grant the proxy's service account get on its state Secret","Clear a corrupt ingress-config key in the state Secret to force a clean rebuild instead of failing unmarshal forever","Expect transient API errors during API server maintenance; let the pod restart retry"],"tags":["kubernetes","secrets","rbac","api-server","ingress"],"backgroundTag":null,"analyzedSha":"cfe32b8be6a33f8e24fbc369cbfbf7c729d9e042","analyzedAt":"2026-08-15T19:58:31.583Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}