tailscale/tailscale · error

failed to generate egress policy: %w

Error message

failed to generate egress policy: %w

What it means

Reconciliation failed while generating the egress ValidatingAdmissionPolicy for the namespace's distinct egress ProxyGroup names. The wrapped error is from the Kubernetes API. The reconcile result is returned as an error so controller-runtime requeues.

Source

Thrown at k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go:146

	// egress/ingress names.
	for _, policy := range policies.Items {
		ingressNames.AddSlice(policy.Spec.Ingress)
		egressNames.AddSlice(policy.Spec.Egress)
	}

	ingress, err := r.generateIngressPolicy(ctx, namespace, ingressNames)
	if err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to generate ingress policy: %w", err)
	}

	ingressBinding, err := r.generatePolicyBinding(ctx, namespace, ingress)
	if err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to generate ingress policy binding: %w", err)
	}

	egress, err := r.generateEgressPolicy(ctx, namespace, egressNames)
	if err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to generate egress policy: %w", err)
	}

	egressBinding, err := r.generatePolicyBinding(ctx, namespace, egress)
	if err != nil {
		return reconcile.Result{}, fmt.Errorf("failed to generate egress policy binding: %w", err)
	}

	objects := []client.Object{
		ingress,
		ingressBinding,
		egress,
		egressBinding,
	}

	for _, obj := range objects {
		// Attempt to perform an update first as we'll only create these once and continually update them, so it's
		// more likely that an update is needed instead of creation. If the resource does not exist, we'll
		// create it.

View on GitHub (pinned to 0fd2f14deb)

Solutions

1. Check the ProxyGroup custom resource spec for invalid or incomplete egress configuration (missing ports, CIDRs, or service references).
2. Inspect the wrapped error for the underlying validation failure and fix the referenced field in the ProxyGroup spec.
3. Ensure the operator's RBAC and dependencies required to build the egress policy are present in the cluster.

When it happens

Trigger: Thrown at k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go:146 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@0fd2f14deb (2026-08-18). Data as JSON: /api/errors/6512700d9a1b6480. Report an issue: GitHub.