tailscale/tailscale · error

failed to apply StatefulSet for PeerRelay %q: %w

Error message

failed to apply StatefulSet for PeerRelay %q: %w

What it means

Raised in createOrUpdate when ensureStatefulSet cannot fetch the referenced ProxyClass, apply the StatefulSet, or read it back. All replica Secrets were already applied; the workload itself could not be created or updated.

Source

Thrown at k8s-operator/reconciler/peerrelay/peerrelay.go:272

	endpointsByReplica := make(map[int32][]tsapi.PeerRelayEndpoint, len(endpoints))
	for _, ep := range endpoints {
		endpointsByReplica[ep.Replica] = append(endpointsByReplica[ep.Replica], ep)
	}

	for i := int32(0); i < replicas; i++ {
		if err = r.ensureStateSecret(ctx, logger, pr, i); err != nil {
			return reconcile.Result{}, fmt.Errorf("failed to apply state Secret for PeerRelay %q replica %d: %w", pr.Name, i, err)
		}

		if err = r.ensureConfigSecret(ctx, logger, pr, i, endpointsByReplica[i]); err != nil {
			return reconcile.Result{}, fmt.Errorf("failed to apply config Secret for PeerRelay %q replica %d: %w", pr.Name, i, err)
		}
	}

	ss, err := r.ensureStatefulSet(ctx, logger, pr, replicas)
	if err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to apply StatefulSet for PeerRelay %q: %w", pr.Name, err)
	}

	if err = r.deleteDevicesFrom(ctx, logger, pr, replicas); err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to clean up scaled-down tailnet devices for PeerRelay %q: %w", pr.Name, err)
	}

	if err = r.deleteServicesFrom(ctx, logger, pr, replicas); err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to clean up scaled-down Services for PeerRelay %q: %w", pr.Name, err)
	}

	if err = r.deleteConfigSecretsFrom(ctx, logger, pr, replicas); err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to clean up scaled-down config Secrets for PeerRelay %q: %w", pr.Name, err)
	}

	if err = r.writeStatus(ctx, logger, pr, endpoints, replicas, ss); err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to update PeerRelay status for %q: %w", pr.Name, err)
	}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Applying the StatefulSet for the PeerRelay failed; validate the StatefulSet spec and RBAC permissions on StatefulSets, then retry.

When it happens

Trigger: Thrown at k8s-operator/reconciler/peerrelay/peerrelay.go:272 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/2028ce5590b80445. Report an issue: GitHub.