tailscale/tailscale · error

failed to delete config Secrets for PeerRelay %q: %w

Error message

failed to delete config Secrets for PeerRelay %q: %w

What it means

Raised in delete when deleteConfigSecretsFrom (all replicas) cannot list or delete the tailscaled config Secrets. Devices and the StatefulSet are already gone; the finalizer is retained until the Secrets are removed.

Source

Thrown at k8s-operator/reconciler/peerrelay/peerrelay.go:392

		return fmt.Errorf("failed to update PeerRelay status: %w", err)
	}

	return nil
}

func (r *Reconciler) delete(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay) (reconcile.Result, error) {
	logger.Infof("deleting PeerRelay %q", pr.Name)

	if err := r.deleteDevicesFrom(ctx, logger, pr, 0); err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to delete tailnet devices for PeerRelay %q: %w", pr.Name, err)
	}

	if err := r.deleteStatefulSet(ctx, logger, pr); err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to delete StatefulSet for PeerRelay %q: %w", pr.Name, err)
	}

	if err := r.deleteConfigSecretsFrom(ctx, logger, pr, 0); err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to delete config Secrets for PeerRelay %q: %w", pr.Name, err)
	}

	if err := r.deleteServicesFrom(ctx, logger, pr, 0); err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to delete Services for PeerRelay %q: %w", pr.Name, err)
	}

	if err := reconciler.ClearFinalizer(ctx, r.Client, pr, reconciler.Finalizer); err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to remove finalizer from PeerRelay %q: %w", pr.Name, err)
	}

	r.tracker.Remove(pr.UID)
	r.reissuer.RemoveState(pr.Name)

	return reconcile.Result{}, nil
}

func (r *Reconciler) ensureService(ctx context.Context, logger *zap.SugaredLogger, desired *corev1.Service) error {
	logger.Debugf("applying Service %q", desired.Name)

View on GitHub (pinned to 6e0912f979)

Solutions

1. Deleting the config Secrets failed; check RBAC delete permission on Secrets and retry.

When it happens

Trigger: Thrown at k8s-operator/reconciler/peerrelay/peerrelay.go:392 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/474b58c56f92da4c. Report an issue: GitHub.