{"record":{"id":"91c1a120d120dcb8","repo":"tailscale/tailscale","slug":"failed-to-generate-egress-policy-binding-w","errorCode":null,"errorMessage":"failed to generate egress policy binding: %w","messagePattern":"failed to generate egress policy binding: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go","lineNumber":151,"sourceCode":"\n\tingress, err := r.generateIngressPolicy(ctx, namespace, ingressNames)\n\tif err != nil {\n\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to generate ingress policy: %w\", err)\n\t}\n\n\tingressBinding, err := r.generatePolicyBinding(ctx, namespace, ingress)\n\tif err != nil {\n\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to generate ingress policy binding: %w\", err)\n\t}\n\n\tegress, err := r.generateEgressPolicy(ctx, namespace, egressNames)\n\tif err != nil {\n\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to generate egress policy: %w\", err)\n\t}\n\n\tegressBinding, err := r.generatePolicyBinding(ctx, namespace, egress)\n\tif err != nil {\n\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to generate egress policy binding: %w\", err)\n\t}\n\n\tobjects := []client.Object{\n\t\tingress,\n\t\tingressBinding,\n\t\tegress,\n\t\tegressBinding,\n\t}\n\n\tfor _, obj := range objects {\n\t\t// Attempt to perform an update first as we'll only create these once and continually update them, so it's\n\t\t// more likely that an update is needed instead of creation. If the resource does not exist, we'll\n\t\t// create it.\n\t\terr = r.Update(ctx, obj)\n\t\tswitch {\n\t\tcase apierrors.IsNotFound(err):\n\t\t\tif err = r.Create(ctx, obj); err != nil {\n\t\t\t\treturn reconcile.Result{}, fmt.Errorf(\"failed to create %s %q: %w\", obj.GetObjectKind().GroupVersionKind().Kind, obj.GetName(), err)","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/tailscale/tailscale/blob/0fd2f14deb478d09c95f38af2b0d35b492b63520/k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go#L133-L169","documentation":"The ProxyGroupPolicy reconciler builds an egress network policy and then a binding object that attaches that policy to the proxy pods. This error wraps a failure in generatePolicyBinding for the egress policy (typically a Kubernetes API error on create/update), aborting the reconcile.","triggerScenarios":"Thrown at k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go:151 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the ValidatingAdmissionPolicy referenced by the egress policy binding exists and is valid.","Fix the malformed parameters in the ProxyGroup spec that produce an invalid egress policy binding.","Check the wrapped error for the specific field that failed to render and correct it in the ProxyGroup resource."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0fd2f14deb478d09c95f38af2b0d35b492b63520","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}