tailscale/tailscale · error

ingress proxy: error retrieving current status: %w

Error message

ingress proxy: error retrieving current status: %w

What it means

Thrown by ingressProxy.sync when p.getStatus fails. getStatus fetches the proxy's state Secret via the Kubernetes API (kc.GetSecret) and unmarshals the ingress config key from its data; it returns nil,nil when the key is absent, so an error means either the Secret GET failed (connectivity, RBAC, API errors) or the stored status JSON is corrupt.

Source

Thrown at cmd/containerboot/ingressservices.go:99

		}
	}
}

// sync reconciles proxy's firewall rules (iptables or nftables) on ingress config changes:
// - ensures that new firewall rules are added
// - ensures that old firewall rules are deleted
// - updates ingress proxy's status in the state Secret
func (p *ingressProxy) sync(ctx context.Context) error {
	// 1. Get the desired firewall configuration
	cfgs, err := p.getConfigs()
	if err != nil {
		return fmt.Errorf("ingress proxy: error retrieving configs: %w", err)
	}

	// 2. Get the recorded firewall status
	status, err := p.getStatus(ctx)
	if err != nil {
		return fmt.Errorf("ingress proxy: error retrieving current status: %w", err)
	}

	// 3. Ensure that firewall configuration is up to date
	if err := p.syncIngressConfigs(cfgs, status); err != nil {
		return fmt.Errorf("ingress proxy: error syncing configs: %w", err)
	}
	var existingConfigs *ingressservices.Configs
	if status != nil {
		existingConfigs = &status.Configs
	}

	// 4. Update the recorded firewall status
	if !(ingressServicesStatusIsEqual(cfgs, existingConfigs) && p.isCurrentStatus(status)) {
		if err := p.recordStatus(ctx, cfgs); err != nil {
			return fmt.Errorf("ingress proxy: error setting status: %w", err)
		}
	}
	return nil

View on GitHub (pinned to cfe32b8be6)

Solutions

1. Verify the proxy's service account can get the state Secret (kubectl auth can-i get secret/<name> -n <ns>)
2. Check API server connectivity from the pod and kube-apiserver health
3. If the stored status JSON is corrupt, clear the ingress config key in the state Secret so getStatus returns nil and rules are rebuilt from the config file
4. For transient API errors, allow the pod restart to retry once connectivity returns

// preflight: confirm the proxy can read its state Secret
// kubectl auth can-i get secret/<state-secret> --as=system:serviceaccount:<ns>:<sa>

status, err := p.getStatus(ctx)
if err != nil {
    if kubeclient.IsRetryable(err) || errors.Is(err, context.DeadlineExceeded) { // transport/timeout: retry with backoff
        status, err = p.getStatus(ctx)
    }
    if err != nil {
        return fmt.Errorf("ingress proxy: error retrieving current status: %w", err)
    }
}

When it happens

Trigger: API server unreachable or returning errors when the proxy syncs; the proxy's service account lacks get on the state Secret; the state Secret was deleted; a previous writer stored malformed JSON under the ingress config key, failing the unmarshal.

Common situations: Operator ingress proxies during API server outages or node networking issues; RBAC trimmed after the proxy was created; state Secrets hand-edited or partially migrated between operator versions.

Related errors

• user is not an admin
• ingress proxy: error setting status: %w
• failed to list ingresses: %w
• failed to list config Secrets: %w
• error retrieving state secret: %w

AI-assisted analysis of tailscale/tailscale@cfe32b8be6 (2026-08-15). Data as JSON: /api/errors/8eeb375ad9ac81df. Report an issue: GitHub.