tailscale/tailscale · error

ErrPolicyClosed

ErrPolicyClosed

Error message

effective policy closed

What it means

ErrPolicyClosed is returned by Policy.Reload, addSource, removeSource, and replaceSource when the effective policy has been closed: the RSOP object is torn down and further policy operations are refused via closeCh.

Source

Thrown at util/syspolicy/rsop/resultant_policy.go:23

import (
	"errors"
	"fmt"
	"slices"
	"sync/atomic"
	"time"

	"tailscale.com/syncs"
	"tailscale.com/util/syspolicy/internal/loggerx"
	"tailscale.com/util/syspolicy/setting"
	"tailscale.com/util/testenv"

	"tailscale.com/util/syspolicy/source"
)

// ErrPolicyClosed is returned by [Policy.Reload], [Policy.addSource],
// [Policy.removeSource] and [Policy.replaceSource] if the policy has been closed.
var ErrPolicyClosed = errors.New("effective policy closed")

// The minimum and maximum wait times after detecting a policy change
// before reloading the policy. This only affects policy reloads triggered
// by a change in the underlying [source.Store] and does not impact
// synchronous, caller-initiated reloads, such as when [Policy.Reload] is called.
//
// Policy changes occurring within [policyReloadMinDelay] of each other
// will be batched together, resulting in a single policy reload
// no later than [policyReloadMaxDelay] after the first detected change.
// In other words, the effective policy will be reloaded no more often than once
// every 5 seconds, but at most 15 seconds after an underlying [source.Store]
// has issued a policy change callback.
//
// See [Policy.watchReload].
var (
	policyReloadMinDelay = 5 * time.Second
	policyReloadMaxDelay = 15 * time.Second
)

View on GitHub (pinned to 6e0912f979)

Solutions

1. Create a new Policy instead of reusing a closed one
2. Check for closure before invoking policy methods

When it happens

Trigger: Thrown at util/syspolicy/rsop/resultant_policy.go:23 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/19c41c1554d9b304. Report an issue: GitHub.