{"record":{"id":"b27f21a16bd89237","repo":"tailscale/tailscale","slug":"failed-to-get-port-ranges-for-proxyclasses-w","errorCode":null,"errorMessage":"failed to get port ranges for ProxyClasses: %w","messagePattern":"failed to get port ranges for ProxyClasses: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"k8s-operator/reconciler/proxyclass/proxyclass.go","lineNumber":439,"sourceCode":"\tif kubeRange != nil {\n\t\tfor _, pr := range portRanges {\n\t\t\tif !kubeRange.Contains(pr.Port) || (pr.EndPort != 0 && !kubeRange.Contains(pr.EndPort)) {\n\t\t\t\treturn fmt.Errorf(\"range %q is not within Cluster configured range %q\", pr.String(), kubeRange.String())\n\t\t\t}\n\t\t}\n\t}\n\n\tfor _, r := range portRanges {\n\t\tif !r.IsValid() {\n\t\t\treturn fmt.Errorf(\"port range %q is invalid\", r.String())\n\t\t}\n\t}\n\n\t// TODO(ChaosInTheCRD): if a ProxyClass that made another invalid (due to port range clash) is deleted,\n\t// the invalid ProxyClass doesn't get reconciled on, and therefore will not go valid. We should fix this.\n\tproxyClassRanges, err := getPortsForProxyClasses(ctx, c)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get port ranges for ProxyClasses: %w\", err)\n\t}\n\n\tfor _, r := range portRanges {\n\t\tfor pcName, pcr := range proxyClassRanges {\n\t\t\tif pcName == pc.Name {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif pcr.ClashesWith(r) {\n\t\t\t\treturn fmt.Errorf(\"port ranges for ProxyClass %q clash with existing ProxyClass %q\", pc.Name, pcName)\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(portRanges) == 1 {\n\t\treturn nil\n\t}\n\n\tsort.Slice(portRanges, func(i, j int) bool {","sourceCodeStart":421,"sourceCodeEnd":457,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/k8s-operator/reconciler/proxyclass/proxyclass.go#L421-L457","documentation":"Raised in validateNodePortRanges when getPortsForProxyClasses cannot list existing ProxyClasses to check for NodePort range clashes. It is an API read failure, not a validation failure; the ProxyClass cannot be judged valid until the list succeeds.","triggerScenarios":"Thrown at k8s-operator/reconciler/proxyclass/proxyclass.go:439 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Getting port ranges for ProxyClasses failed; check RBAC list permission on ProxyClasses and retry."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}