tailscale/tailscale · error

failed to get ProxyClass %q: %w

Error message

failed to get ProxyClass %q: %w

What it means

Raised in getProxyClass when the PeerRelay spec names a ProxyClass that cannot be fetched (does not exist, or API error). An empty ProxyClass name is skipped; only a non-empty, unresolvable reference fires this, blocking StatefulSet creation.

Source

Thrown at k8s-operator/reconciler/peerrelay/statefulset.go:103

	})

	return tailscaled.ApplyProxyClass(ss, pc, managedLabelKeys, nil)
}

var managedLabelKeys = []string{
	kubetypes.LabelManaged,
	reconciler.LabelParentType,
	reconciler.LabelParentName,
}

func (r *Reconciler) getProxyClass(ctx context.Context, pr *tsapi.PeerRelay) (*tsapi.ProxyClass, error) {
	if pr.Spec.ProxyClass == "" {
		return nil, nil
	}

	var pc tsapi.ProxyClass
	if err := r.Get(ctx, types.NamespacedName{Name: pr.Spec.ProxyClass}, &pc); err != nil {
		return nil, fmt.Errorf("failed to get ProxyClass %q: %w", pr.Spec.ProxyClass, err)
	}
	return &pc, nil
}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Getting the ProxyClass failed; verify the named ProxyClass exists and the operator has get permission on ProxyClasses.

When it happens

Trigger: Thrown at k8s-operator/reconciler/peerrelay/statefulset.go:103 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/6c11f99249c081dc. Report an issue: GitHub.