tailscale/tailscale · error

failed to apply StatefulSet: %w

Error message

failed to apply StatefulSet: %w

What it means

Raised in ensureStatefulSet when server-side apply of the PeerRelay's StatefulSet fails. The ProxyClass was already resolved and merged; a validation rejection from the API server, admission webhook, or RBAC gap produces this.

Source

Thrown at k8s-operator/reconciler/peerrelay/peerrelay.go:513

		if err := r.Delete(ctx, secret); err != nil && !apierrors.IsNotFound(err) {
			return fmt.Errorf("failed to delete config Secret %q: %w", secret.Name, err)
		}
	}

	return nil
}

func (r *Reconciler) ensureStatefulSet(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay, replicas int32) (*appsv1.StatefulSet, error) {
	pc, err := r.getProxyClass(ctx, pr)
	if err != nil {
		return nil, err
	}

	desired := r.peerRelayStatefulSet(pr, replicas, pc)

	logger.Debugf("applying StatefulSet %q", desired.Name)
	if err = r.Patch(ctx, desired, client.Apply, fieldOwner, client.ForceOwnership); err != nil {
		return nil, fmt.Errorf("failed to apply StatefulSet: %w", err)
	}

	var current appsv1.StatefulSet
	if err = r.Get(ctx, types.NamespacedName{Namespace: desired.Namespace, Name: desired.Name}, &current); err != nil {
		return nil, fmt.Errorf("failed to get StatefulSet: %w", err)
	}

	return &current, nil
}

func (r *Reconciler) deleteStatefulSet(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay) error {
	ss := &appsv1.StatefulSet{
		ObjectMeta: metav1.ObjectMeta{Name: resourceName(pr.Name), Namespace: r.tailscaleNamespace},
	}
	logger.Debugf("deleting StatefulSet %q", ss.Name)
	if err := r.Delete(ctx, ss); err != nil && !apierrors.IsNotFound(err) {
		return fmt.Errorf("failed to delete StatefulSet: %w", err)
	}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Applying the StatefulSet failed; validate the StatefulSet spec and RBAC permissions, then retry.

When it happens

Trigger: Thrown at k8s-operator/reconciler/peerrelay/peerrelay.go:513 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/d499543bd880d0fd. Report an issue: GitHub.