tailscale/tailscale · error

failed to get port ranges for ProxyClasses: %w

Error message

failed to get port ranges for ProxyClasses: %w

What it means

Raised in validateNodePortRanges when getPortsForProxyClasses cannot list existing ProxyClasses to check for NodePort range clashes. It is an API read failure, not a validation failure; the ProxyClass cannot be judged valid until the list succeeds.

Source

Thrown at k8s-operator/reconciler/proxyclass/proxyclass.go:439

	if kubeRange != nil {
		for _, pr := range portRanges {
			if !kubeRange.Contains(pr.Port) || (pr.EndPort != 0 && !kubeRange.Contains(pr.EndPort)) {
				return fmt.Errorf("range %q is not within Cluster configured range %q", pr.String(), kubeRange.String())
			}
		}
	}

	for _, r := range portRanges {
		if !r.IsValid() {
			return fmt.Errorf("port range %q is invalid", r.String())
		}
	}

	// TODO(ChaosInTheCRD): if a ProxyClass that made another invalid (due to port range clash) is deleted,
	// the invalid ProxyClass doesn't get reconciled on, and therefore will not go valid. We should fix this.
	proxyClassRanges, err := getPortsForProxyClasses(ctx, c)
	if err != nil {
		return fmt.Errorf("failed to get port ranges for ProxyClasses: %w", err)
	}

	for _, r := range portRanges {
		for pcName, pcr := range proxyClassRanges {
			if pcName == pc.Name {
				continue
			}
			if pcr.ClashesWith(r) {
				return fmt.Errorf("port ranges for ProxyClass %q clash with existing ProxyClass %q", pc.Name, pcName)
			}
		}
	}

	if len(portRanges) == 1 {
		return nil
	}

	sort.Slice(portRanges, func(i, j int) bool {

View on GitHub (pinned to 6e0912f979)

Solutions

1. Getting port ranges for ProxyClasses failed; check RBAC list permission on ProxyClasses and retry.

When it happens

Trigger: Thrown at k8s-operator/reconciler/proxyclass/proxyclass.go:439 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/b27f21a16bd89237. Report an issue: GitHub.