tailscale/tailscale · error

admission controller: %v/%v not allowed

Error message

admission controller: %v/%v not allowed

What it means

verifyClient: the admission controller responded successfully but its DERPAdmitClientResponse had Allow=false for this client key/IP pair. A policy rejection: the derper refuses to serve this client by design.

Source

Thrown at derp/derpserver/derpserver.go:1656

		}
		res, err := http.DefaultClient.Do(req)
		if err != nil {
			if s.verifyClientsURLFailOpen {
				s.logf("admission controller unreachable; allowing client %v", clientKey)
				return nil
			}
			return err
		}
		defer res.Body.Close()
		if res.StatusCode != 200 {
			return fmt.Errorf("admission controller: %v", res.Status)
		}
		var jres tailcfg.DERPAdmitClientResponse
		if err := json.NewDecoder(io.LimitReader(res.Body, 4<<10)).Decode(&jres); err != nil {
			return err
		}
		if !jres.Allow {
			return fmt.Errorf("admission controller: %v/%v not allowed", clientKey, clientIP)
		}
		// TODO(bradfitz): add policy for configurable bandwidth rate per client?
	}
	return nil
}

func (s *Server) sendServerKey(lw *lazyBufioWriter) error {
	buf := make([]byte, 0, len(derp.Magic)+key.NodePublicRawLen)
	buf = append(buf, derp.Magic...)
	buf = s.publicKey.AppendTo(buf)
	err := derp.WriteFrame(lw.bw(), derp.FrameServerKey, buf)
	lw.Flush() // redundant (no-op) flush to release bufio.Writer
	return err
}

func (s *Server) noteClientActivity(c *sclient) {
	if !c.isDup.Load() {
		// Fast path for clients that aren't in a dup set.

View on GitHub (pinned to a7769cbc33)

Solutions

1. Update the admission controller policy to allow this client's node key
2. Verify the client IP/source presented to the controller matches what policy permits
3. Have the client re-authenticate or rotate to a node key that policy admits

When it happens

Trigger: Thrown at derp/derpserver/derpserver.go:1637 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@a7769cbc33 (2026-08-18). Data as JSON: /api/errors/3ba1da500397bf4b. Report an issue: GitHub.