tailscale/tailscale · error

failed to get ValidatingAdmissionPolicyBinding %q: %w

Error message

failed to get ValidatingAdmissionPolicyBinding %q: %w

What it means

generatePolicyBinding fetches the existing ValidatingAdmissionPolicyBinding to reuse its resourceVersion. A not-found result is fine, but any other API error (RBAC, connectivity, API server) is fatal and wrapped here with the binding name.

Source

Thrown at k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go:368

	if len(values) == 0 {
		message = denyMessage
	}

	return admr.Validation{
		Expression: fmt.Sprintf(format, joined),
		Message:    message,
	}
}

func (r *Reconciler) generatePolicyBinding(ctx context.Context, namespace string, policy *admr.ValidatingAdmissionPolicy) (*admr.ValidatingAdmissionPolicyBinding, error) {
	var binding admr.ValidatingAdmissionPolicyBinding
	err := r.Get(ctx, client.ObjectKey{Name: policy.Name}, &binding)
	switch {
	case apierrors.IsNotFound(err):
		// If it's not found, we can create a new one. We only want the existing one for
		// its resource version.
	case err != nil:
		return nil, fmt.Errorf("failed to get ValidatingAdmissionPolicyBinding %q: %w", policy.Name, err)
	}

	return &admr.ValidatingAdmissionPolicyBinding{
		ObjectMeta: metav1.ObjectMeta{
			Name:            policy.Name,
			ResourceVersion: binding.ResourceVersion,
		},
		Spec: admr.ValidatingAdmissionPolicyBindingSpec{
			PolicyName: policy.Name,
			ValidationActions: []admr.ValidationAction{
				admr.Deny,
			},
			MatchResources: &admr.MatchResources{
				NamespaceSelector: &metav1.LabelSelector{
					MatchLabels: map[string]string{
						"kubernetes.io/metadata.name": namespace,
					},
				},

View on GitHub (pinned to 0fd2f14deb)

Solutions

1. Confirm the ValidatingAdmissionPolicyBinding with the quoted name exists: kubectl get validatingadmissionpolicybinding <name>.
2. Ensure the operator service account has get permission for validatingadmissionpolicybindings.
3. If the binding was deleted out of band, allow reconcile to recreate it or fix the ProxyGroup reference.

When it happens

Trigger: Thrown at k8s-operator/reconciler/proxygrouppolicy/proxygrouppolicy.go:368 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@0fd2f14deb (2026-08-18). Data as JSON: /api/errors/dd69d0fbbda36da9. Report an issue: GitHub.