tailscale/tailscale · error

error loading state from kube Secret: %w

Error message

error loading state from kube Secret: %w

What it means

Reading the operator's state Secret from the Kubernetes API failed during kubestore construction (with NotFound already mapped to a fresh store), so persistent tailscale state could not be loaded and the store cannot start.

Source

Thrown at ipn/store/kubestore/store_kube.go:146

		s.certShareMode = "rw"
	} else if envknob.IsCertShareReadOnlyMode() {
		s.certShareMode = "ro"
	}

	// Configure shared ACME account lookup. Only meaningful for the cert
	// issuer (cert share "rw") — read replicas never issue.
	if s.certShareMode == "rw" {
		s.acmeAccountsSecretName = os.Getenv("TS_ACME_ACCOUNT_SECRET_NAME")
		s.acmeAccountField = os.Getenv("TS_ACME_ACCOUNT_FIELD")
		if s.acmeAccountsSecretName != "" && s.acmeAccountField == "" {
			s.logf("[unexpected] TS_ACME_ACCOUNT_SECRET_NAME set without TS_ACME_ACCOUNT_FIELD; ignoring shared ACME account configuration")
			s.acmeAccountsSecretName = ""
		}
	}

	// Load latest state from kube Secret if it already exists.
	if err := s.loadState(); err != nil && err != ipn.ErrStateNotExist {
		return nil, fmt.Errorf("error loading state from kube Secret: %w", err)
	}
	// If we are in read-only cert share mode, pre-load existing shared certs.
	// Write replicas never load certs in-memory to avoid a situation where,
	// after Ingress recreation (and the associated cert Secret recreation), new
	// TLS certs don't get issued because the write replica still has certs
	// in-memory. Instead, write replicas fetch certs from Secret on each request.
	if s.certShareMode == "ro" {
		sel := s.certSecretSelector()
		if err := s.loadCerts(context.Background(), sel); err != nil {
			// We will attempt to again retrieve the certs from Secrets when a request for an HTTPS endpoint
			// is received.
			s.logf("[unexpected] error loading TLS certs: %v", err)
		}
	}
	if s.certShareMode == "ro" {
		go s.runCertReload(context.Background())
	}
	if s.acmeAccountsSecretName != "" {

View on GitHub (pinned to 6e0912f979)

Solutions

1. Loading state from the Kubernetes Secret failed; verify the Secret exists, the pod's service account has get permission on it, and the stored data is valid.

When it happens

Trigger: Thrown at ipn/store/kubestore/store_kube.go:146 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/66017a1768ed6da6. Report an issue: GitHub.