{"record":{"id":"dd69d0fbbda36da9","repo":"tailscale/tailscale","slug":"failed-to-get-validatingadmissionpolicybinding-q","errorCode":null,"errorMessage":"failed to get ValidatingAdmissionPolicyBinding %q: %w","messagePattern":"failed to get ValidatingAdmissionPolicyBinding %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go","lineNumber":368,"sourceCode":"\tif len(values) == 0 {\n\t\tmessage = denyMessage\n\t}\n\n\treturn admr.Validation{\n\t\tExpression: fmt.Sprintf(format, joined),\n\t\tMessage:    message,\n\t}\n}\n\nfunc (r *Reconciler) generatePolicyBinding(ctx context.Context, namespace string, policy *admr.ValidatingAdmissionPolicy) (*admr.ValidatingAdmissionPolicyBinding, error) {\n\tvar binding admr.ValidatingAdmissionPolicyBinding\n\terr := r.Get(ctx, client.ObjectKey{Name: policy.Name}, &binding)\n\tswitch {\n\tcase apierrors.IsNotFound(err):\n\t\t// If it's not found, we can create a new one. We only want the existing one for\n\t\t// its resource version.\n\tcase err != nil:\n\t\treturn nil, fmt.Errorf(\"failed to get ValidatingAdmissionPolicyBinding %q: %w\", policy.Name, err)\n\t}\n\n\treturn &admr.ValidatingAdmissionPolicyBinding{\n\t\tObjectMeta: metav1.ObjectMeta{\n\t\t\tName:            policy.Name,\n\t\t\tResourceVersion: binding.ResourceVersion,\n\t\t},\n\t\tSpec: admr.ValidatingAdmissionPolicyBindingSpec{\n\t\t\tPolicyName: policy.Name,\n\t\t\tValidationActions: []admr.ValidationAction{\n\t\t\t\tadmr.Deny,\n\t\t\t},\n\t\t\tMatchResources: &admr.MatchResources{\n\t\t\t\tNamespaceSelector: &metav1.LabelSelector{\n\t\t\t\t\tMatchLabels: map[string]string{\n\t\t\t\t\t\t\"kubernetes.io/metadata.name\": namespace,\n\t\t\t\t\t},\n\t\t\t\t},","sourceCodeStart":350,"sourceCodeEnd":386,"githubUrl":"https://github.com/tailscale/tailscale/blob/0fd2f14deb478d09c95f38af2b0d35b492b63520/k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go#L350-L386","documentation":"generatePolicyBinding fetches the existing ValidatingAdmissionPolicyBinding to reuse its resourceVersion. A not-found result is fine, but any other API error (RBAC, connectivity, API server) is fatal and wrapped here with the binding name.","triggerScenarios":"Thrown at k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go:368 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the ValidatingAdmissionPolicyBinding with the quoted name exists: kubectl get validatingadmissionpolicybinding <name>.","Ensure the operator service account has get permission for validatingadmissionpolicybindings.","If the binding was deleted out of band, allow reconcile to recreate it or fix the ProxyGroup reference."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0fd2f14deb478d09c95f38af2b0d35b492b63520","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}