{"record":{"id":"e7273cd3b4c18358","repo":"tailscale/tailscale","slug":"error-getting-tailscale-service-q-w","errorCode":null,"errorMessage":"error getting Tailscale Service %q: %w","messagePattern":"error getting Tailscale Service %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/k8s-operator/api-server-proxy-pg.go","lineNumber":166,"sourceCode":"\t}\n\n\tif !slices.Contains(pg.Finalizers, proxyPGFinalizerName) {\n\t\t// This log line is printed exactly once during initial provisioning,\n\t\t// because once the finalizer is in place this block gets skipped. So,\n\t\t// this is a nice place to tell the operator that the high level,\n\t\t// multi-reconcile operation is underway.\n\t\tlogger.Info(\"provisioning Tailscale Service for ProxyGroup\")\n\t\tpg.Finalizers = append(pg.Finalizers, proxyPGFinalizerName)\n\t\tif err := r.Update(ctx, pg); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to add finalizer: %w\", err)\n\t\t}\n\t}\n\n\t// 1. Check there isn't a Tailscale Service with the same hostname\n\t// already created and not owned by this ProxyGroup.\n\texistingTSSvc, err := tsClient.VIPServices().Get(ctx, serviceName.String())\n\tif err != nil && !tailscale.IsNotFound(err) {\n\t\treturn fmt.Errorf(\"error getting Tailscale Service %q: %w\", serviceName, err)\n\t}\n\n\tupdatedAnnotations, err := exclusiveOwnerAnnotations(pg, r.operatorID, existingTSSvc)\n\tif err != nil {\n\t\tconst instr = \"To proceed, you can either manually delete the existing Tailscale Service or choose a different Service name in the ProxyGroup's spec.kubeAPIServer.serviceName field\"\n\t\tmsg := fmt.Sprintf(\"error ensuring exclusive ownership of Tailscale Service %s: %v. %s\", serviceName, err, instr)\n\t\tlogger.Warn(msg)\n\t\tr.recorder.Event(pg, corev1.EventTypeWarning, \"InvalidTailscaleService\", msg)\n\t\ttsoperator.SetProxyGroupCondition(pg, tsapi.KubeAPIServerProxyValid, metav1.ConditionFalse, reasonKubeAPIServerProxyInvalid, msg, pg.Generation, r.clock, logger)\n\t\treturn nil\n\t}\n\n\t// After getting this far, we know the Tailscale Service is valid.\n\ttsoperator.SetProxyGroupCondition(pg, tsapi.KubeAPIServerProxyValid, metav1.ConditionTrue, reasonKubeAPIServerProxyValid, reasonKubeAPIServerProxyValid, pg.Generation, r.clock, logger)\n\n\t// Service tags are limited to matching the ProxyGroup's tags until we have\n\t// support for querying peer caps for a Service-bound request.\n\tserviceTags := r.defaultTags","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/tailscale/tailscale/blob/cfe32b8be6a33f8e24fbc369cbfbf7c729d9e042/cmd/k8s-operator/api-server-proxy-pg.go#L148-L184","documentation":"Error \"error getting Tailscale Service %q: %w\" thrown in tailscale/tailscale.","triggerScenarios":"Thrown at cmd/k8s-operator/api-server-proxy-pg.go:166 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"cfe32b8be6a33f8e24fbc369cbfbf7c729d9e042","analyzedAt":"2026-08-15T19:58:31.583Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}