{"record":{"id":"b3edd5e6df72ed71","repo":"tailscale/tailscale","slug":"invalid-proxy-firewall-mode-s-valid-modes-are-ip","errorCode":null,"errorMessage":"invalid proxy firewall mode %s, valid modes are iptables, nftables or unset","messagePattern":"invalid proxy firewall mode (.+?), valid modes are iptables, nftables or unset","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/k8s-operator/sts.go","lineNumber":194,"sourceCode":"type tsnetServer interface {\n\tCertDomains() []string\n}\n\ntype tailscaleSTSReconciler struct {\n\tclient.Client\n\ttsnetServer            tsnetServer\n\tclients                ClientProvider\n\tdefaultTags            []string\n\toperatorNamespace      string\n\tproxyImage             string\n\tproxyPriorityClassName string\n\ttsFirewallMode         string\n\tloginServer            string\n}\n\nfunc (r *tailscaleSTSReconciler) validate() error {\n\tif r.tsFirewallMode != \"\" && !isValidFirewallMode(r.tsFirewallMode) {\n\t\treturn fmt.Errorf(\"invalid proxy firewall mode %s, valid modes are iptables, nftables or unset\", r.tsFirewallMode)\n\t}\n\treturn nil\n}\n\n// IsHTTPSEnabledOnTailnet reports whether HTTPS is enabled on the tailnet.\nfunc IsHTTPSEnabledOnTailnet(tsnetServer tsnetServer) bool {\n\treturn len(tsnetServer.CertDomains()) > 0\n}\n\n// Provision ensures that the StatefulSet for the given service is running and\n// up to date.\nfunc (r *tailscaleSTSReconciler) Provision(ctx context.Context, logger *zap.SugaredLogger, sts *tailscaleSTSConfig) (*corev1.Service, error) {\n\t// Do full reconcile.\n\t// TODO (don't create Service for the Connector)\n\thsvc, err := r.reconcileHeadlessService(ctx, logger, sts)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to reconcile headless service: %w\", err)\n\t}","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/tailscale/tailscale/blob/cfe32b8be6a33f8e24fbc369cbfbf7c729d9e042/cmd/k8s-operator/sts.go#L176-L212","documentation":"Error \"invalid proxy firewall mode %s, valid modes are iptables, nftables or unset\" thrown in tailscale/tailscale.","triggerScenarios":"Thrown at cmd/k8s-operator/sts.go:194 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"cfe32b8be6a33f8e24fbc369cbfbf7c729d9e042","analyzedAt":"2026-08-15T19:58:31.583Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}