tailscale/tailscale · error

ProxyGroup %q is of type %q but must be of type %q

Error message

ProxyGroup %q is of type %q but must be of type %q

What it means

Error "ProxyGroup %q is of type %q but must be of type %q" thrown in tailscale/tailscale.

Source

Thrown at cmd/k8s-operator/svc-for-pg.go:819

	if err != nil {
		return false, fmt.Errorf("failed to list EndpointSlices for Service %q: %w", svc.Name, err)
	}
	for _, eps := range epss {
		for _, ep := range eps.Endpoints {
			if *ep.Conditions.Ready {
				return true, nil
			}
		}
	}

	logger.Debugf("could not find any ready Endpoints in EndpointSlice")
	return false, nil
}

func (r *HAServiceReconciler) validateService(ctx context.Context, svc *corev1.Service, pg *tsapi.ProxyGroup) error {
	var errs []error
	if pg.Spec.Type != tsapi.ProxyGroupTypeIngress {
		errs = append(errs, fmt.Errorf("ProxyGroup %q is of type %q but must be of type %q",
			pg.Name, pg.Spec.Type, tsapi.ProxyGroupTypeIngress))
	}
	if violations := validateService(svc); len(violations) > 0 {
		errs = append(errs, fmt.Errorf("invalid Service: %s", strings.Join(violations, ", ")))
	}
	svcList := &corev1.ServiceList{}
	if err := r.List(ctx, svcList); err != nil {
		errs = append(errs, fmt.Errorf("error listing Services: %w", err))
		return errors.Join(errs...)
	}
	svcName := nameForService(svc)
	for _, s := range svcList.Items {
		if s.UID == svc.UID {
			continue
		}
		// Only check services managed by the ProxyGroup reconciler. Services
		// exposed via the single-proxy path in svc.go have their own
		// hostname tracking and live in a separate per-proxy tailnet

View on GitHub (pinned to cfe32b8be6)

When it happens

Trigger: Thrown at cmd/k8s-operator/svc-for-pg.go:819 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@cfe32b8be6 (2026-08-15). Data as JSON: /api/errors/129087ad56678b2c. Report an issue: GitHub.