{"slug":"troubleshooting-kubernetes-operator-issues","title":"Troubleshooting Kubernetes operator issues","tags":["tailscale","containers"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Troubleshooting Kubernetes operator issues\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nThe following sections provide suggestions and tips to help troubleshoot common Kubernetes operator issues.\r\n\r\n## [Using logs](https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator\\#using-logs)\r\n\r\nIf you are experiencing issues with your installation, it might be useful to take a look at the operator logs.\r\n\r\nFor [ingress](https://tailscale.com/docs/features/kubernetes-operator/how-to/cluster-ingress) and [egress](https://tailscale.com/docs/features/kubernetes-operator/how-to/cluster-egress) proxies and the `Connector`, the operator creates a single replica `StatefulSet` in the `tailscale` namespace that is responsible for proxying the traffic to and from the tailnet. If the `StatefulSet` has been successfully created, you should also look at the logs of its `Pod`.\r\n\r\n### [Operator logs](https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator\\#operator-logs)\r\n\r\nYou can increase operator's log level to get debug logs.\r\n\r\nTo set the log level to `debug` for an operator deployed using Helm, run:\r\n\r\n```shell\r\nhelm upgrade --install \\\r\n  operator tailscale/tailscale-operator \\\r\n  --set operatorConfig.logging=debug\r\n```\r\n\r\nIf you deployed the operator using [static manifests](https://tailscale.com/docs/features/kubernetes-operator#static-manifests-with-kubectl), you can set `OPERATOR_LOGGING` environment variable for the operator's `Deployment` to `debug`.\r\n\r\nTo review the logs, run:\r\n\r\n```shell\r\nkubectl logs deployment/operator --namespace tailscale\r\n```\r\n\r\n### [Proxy logs and events](https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator\\#proxy-logs-and-events)\r\n\r\nTo get logs and events for the proxy created for an [`Ingress`](https://tailscale.com/docs/features/kubernetes-operator/how-to/cluster-ingress#ingress-resource) resource, run:\r\n\r\n```shell\r\npod_name=$(kubectl get pod --selector=tailscale.com/parent-resource-type=ingress,tailscale.com/parent-resource=<ingress-name>,tailscale.com/parent-resource-ns=<ingress-namespace> \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl logs ${pod_name} --namespace tailscale\r\nkubectl describe pod ${pod_name} --namespace tailscale\r\n```\r\n\r\nTo get logs and events for a proxy created for an [ingress](https://tailscale.com/docs/features/kubernetes-operator/how-to/cluster-ingress) or [egress](https://tailscale.com/docs/features/kubernetes-operator/how-to/cluster-egress)`Service`, run:\r\n\r\n```shell\r\npod_name=$(kubectl get pod --selector=tailscale.com/parent-resource-type=svc,tailscale.com/parent-resource=<service-name>,tailscale.com/parent-resource-ns=<service-namespace> \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl logs ${pod_name} --namespace tailscale\r\nkubectl describe pod ${pod_name} --namespace tailscale\r\n```\r\n\r\nTo get logs and events for a proxy created for a `Connector`, run:\r\n\r\n```shell\r\npod_name=$(kubectl get pod --selector=tailscale.com/parent-resource-type=connector,tailscale.com/parent-resource=<connector-name> \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl logs ${pod_name} --namespace tailscale\r\nkubectl describe pod ${pod_name} --namespace tailscale\r\n```\r\n\r\nTo get logs and events for a proxy created for a `ProxyGroup`, run:\r\n\r\n```shell\r\npod_name=$(kubectl get pod --selector=tailscale.com/parent-resource-type=proxygroup,tailscale.com/parent-resource=<proxy-group-name> \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl logs ${pod_name} --namespace tailscale\r\nkubectl describe pod ${pod_name} --namespace tailscale\r\n```\r\n\r\n## [Cluster egress/cluster ingress proxies](https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator\\#cluster-egresscluster-ingress-proxies)\r\n\r\nThe proxy pod is deployed in the `tailscale` namespace, and will have a name of the form `ts-<annotated-service-name>-<random-string>`.\r\n\r\nIf there are issues reaching the external service, verify the proxy pod is properly deployed:\r\n\r\n- Review the logs and events of the proxy pods.\r\n- Review the logs of the operator. You can do this by running `kubectl logs deploy/operator --namespace tailscale`. The log level can be configured using the `OPERATOR_LOGGING` environment variable in the operator's [manifest file](https://github.com/tailscale/tailscale/blob/main/cmd/k8s-operator/deploy/manifests/operator.yaml).\r\n- Verify that the cluster workload can send traffic to the proxy pod in the `tailscale` namespace.\r\n\r\n## [TLS connection errors](https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator\\#tls-connection-errors)\r\n\r\nIf you are connecting to a workload exposed to the tailnet over `Ingress` or to the `kube` API server over the operator's API server proxy, you can sometimes run into TLS connection errors.\r\n\r\nCheck the following, in sequence:\r\n\r\n1. HTTPS is not enabled for the tailnet.\r\n\r\nTo use Tailscale `Ingress` or API server proxy, you must ensure that [HTTPS is enabled for your tailnet](https://tailscale.com/docs/how-to/set-up-https-certificates).\r\n\r\n2. Let's Encrypt certificate has not yet been provisioned.\r\n\r\nIf HTTPS is enabled, the errors are most likely related to Let's Encrypt certificate provisioning flow.\r\n\r\nFor each Tailscale `Ingress` resource, the operator deploys a Tailscale node that runs a TLS server. This server is provisioned with a Let's Encrypt certificate for the MagicDNS name of the node. For the API server proxy, the operator also runs an in-process TLS server that proxies tailnet traffic to the Kubernetes API server. This server gets provisioned with a Let's Encrypt certificate for the MagicDNS name of the operator.\r\n\r\nIn both cases, the certificates are provisioned lazily the first time a client connects to the server. Provisioning takes some time, so you might receive some TLS timeout errors.\r\n\r\nYou can examine the logs to follow the certificate provisioning process:\r\n\r\nFor API server proxy, review the operator's logs:\r\n\r\n\r\n- For API server proxy, review the [operator logs](https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#operator-logs).\r\n\r\n- For `Ingress`, review the [proxy logs](https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#proxy-logs).\r\n\r\nThere is nothing you can currently do to prevent the first client connection sometimes raising an error. Do [reach out](https://github.com/tailscale/tailscale/issues/new/choose) if this is causing issues for your workflow.\r\n\r\n\r\n1. You have hit Let's Encrypt rate limits.\r\n\r\nIf the connection does not succeed even after first attempt to connect, you should verify that you have not hit [Let's Encrypt rate limits](https://letsencrypt.org/docs/rate-limits). If a limit has been hit, you will be able to find the error returned from Let's Encrypt in the logs.\r\n\r\nWe are currently working on making it less likely for users to hit Let's Encrypt rate limits. Refer to related discussion in [`tailscale/tailscale#11119`](https://github.com/tailscale/tailscale/issues/11119).\r\n\r\n\r\n## [OAuth client and tagging issues](https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator\\#oauth-client-and-tagging-issues)\r\n\r\nIf you're experiencing issues with the operator not being properly tagged or having permission issues, check the following:\r\n\r\n1. **OAuth client scopes**: Ensure your OAuth client has both the `devices:core` and `auth_keys` scopes with write permissions.\r\n\r\n2. **OAuth client tag permissions**: The OAuth client must have permission to use all tags you want to apply to the operator. For example, if your `operatorConfig.defaultTags` specifies multiple tags like `tag:k8s-operator,tag:k8s-test`, your OAuth client must have permission to use`tag:k8s-operator`.\r\n\r\n3. **Tag ownership in ACL**: Check that your tag ownership is properly configured in your tailnet policy file.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\n\"tagOwners\": {\r\n     \"tag:k8s-operator\": [],\r\n     \"tag:k8s-test\": [\"tag:k8s-operator\"],\r\n}\r\n```\r\n\r\n4. **Refresh operator state**:\r\n   - If you've updated your ACL policy, the changes will be applied automatically and don't require any restart.\r\n\r\n   - If you've created a new OAuth client to replace the previous one, you must reinstall the operator completely to ensure a new key is created. Follow the [installation instructions](https://tailscale.com/docs/features/kubernetes-operator#setup) again with the new OAuth client credentials.\r\n5. **Check OAuth client in console**: Verify in the Tailscale admin console that your OAuth client has the exact tags you want to apply to the operator. Remember that each tag's permissions are evaluated independently.\r\n\r\n6. **Inspect operator logs**: Look for authorization errors or tag-related messages in the [operator logs](https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#operator-logs).\r\n\r\n\r\n## [Tailscale Ingress troubleshooting](https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator\\#tailscale-ingress-troubleshooting)\r\n\r\nThis section contains additional information for troubleshooting Tailscale `Ingress`.\r\n\r\n- Check that the operator has configured the ingress proxy correctly:\r\n\r\nFor example, if you have a Tailscale `Ingress` with a backend `Service` similar to these:\r\n\r\n```yaml\r\napiVersion: networking.k8s.io/v1\r\nkind: Ingress\r\nmetadata:\r\nname: my-app\r\nspec:\r\ningressClassName: tailscale\r\nrules:\r\n- http:\r\n    paths:\r\n    - backend:\r\n        service:\r\n          name: my-app\r\n          port:\r\n            number: 80\r\n      path: /login\r\n      pathType: Prefix\r\ntls:\r\n- hosts:\r\n  - my-app\r\n---\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\nname: my-app\r\nspec:\r\nclusterIP: 192.0.2.9\r\nports:\r\n- port: 80\r\n```\r\n\r\n- Validate that the ingress proxy's configuration matches:\r\n\r\n```shell\r\nINGRESS_NAME=<ingress-resource-name> \\\r\nINGRESS_NAMESPACE=<ingress-resource-namespace> \\\r\nsecret_name=$(kubectl get secret --selector=tailscale.com/parent-resource-type=ingress,tailscale.com/parent-resource=${INGRESS_NAME},tailscale.com/parent-resource-ns=${INGRESS_NAMESPACE} \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl get secret ${secret_name} -n tailscale -ojsonpath={.data.serve-config} | base64 -d\r\n'{\"TCP\":{\"443\":{\"HTTPS\":true}},\"Web\":{\"${TS_CERT_DOMAIN}:443\":{\"Handlers\":{\"/login\":{\"Proxy\":\"http://192.0.2.9:80/\"}}}}}'\r\n```\r\n\r\nIf the configuration appears to be incorrect, check the operator logs for any errors relating to configuring the `Ingress`.\r\n\r\n- Check that the ingress proxy has loaded the configuration.\r\n\r\nRun the following command to review the current proxy's configuration:\r\n\r\n```shell\r\nINGRESS_NAME=<ingress-resource-name> \\\r\nINGRESS_NAMESPACE=<ingress-resource-namespace> \\\r\npod_name=$(kubectl get pod --selector=tailscale.com/parent-resource-type=ingress,tailscale.com/parent-resource=${INGRESS_NAME},tailscale.com/parent-resource-ns=${INGRESS_NAMESPACE} \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl exec ${pod_name} --namespace tailscale -- tailscale serve status\r\nhttps://my-app.<tailnetxyz>.ts.net (tailnet only)\r\n|-- / proxy http://192.0.2.9:80/\r\n```\r\n\r\nIf the configuration appears to be incorrect, check the proxy `Pod`'s logs.\r\n\r\n- Verify that the `Service` backend is reachable from the ingress proxy `Pod`:\r\n\r\n```shell\r\nINGRESS_NAME=<ingress-resource-name> \\\r\nINGRESS_NAMESPACE=<ingress-resource-namespace> \\\r\npod_name=$(kubectl get pod --selector=tailscale.com/parent-resource-type=ingress,tailscale.com/parent-resource=${INGRESS_NAME},tailscale.com/parent-resource-ns=${INGRESS_NAMESPACE} \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl exec -it ${pod_name} -n tailscale -- sh \\\r\napk add curl \\\r\ncurl http://192.0.2.9:80/\r\n```\r\n\r\nIf the backend cannot be reached, the issue is likely related to cluster connectivity from `tailscale` namespace.\r\nVerify that you don't have a `NetworkPolicy` in place that prevents `Pod`s in `tailscale` namespace to talk to the `Ingress` backend.\r\n","html":"<h1>Troubleshooting Kubernetes operator issues</h1>\n<p>Last validated: Jan 5, 2026</p>\n<p>The following sections provide suggestions and tips to help troubleshoot common Kubernetes operator issues.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#using-logs\">Using logs</a></h2>\n<p>If you are experiencing issues with your installation, it might be useful to take a look at the operator logs.</p>\n<p>For <a href=\"https://tailscale.com/docs/features/kubernetes-operator/how-to/cluster-ingress\">ingress</a> and <a href=\"https://tailscale.com/docs/features/kubernetes-operator/how-to/cluster-egress\">egress</a> proxies and the <code>Connector</code>, the operator creates a single replica <code>StatefulSet</code> in the <code>tailscale</code> namespace that is responsible for proxying the traffic to and from the tailnet. If the <code>StatefulSet</code> has been successfully created, you should also look at the logs of its <code>Pod</code>.</p>\n<h3><a href=\"https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#operator-logs\">Operator logs</a></h3>\n<p>You can increase operator's log level to get debug logs.</p>\n<p>To set the log level to <code>debug</code> for an operator deployed using Helm, run:</p>\n<pre><code class=\"language-shell\">helm upgrade --install \\\r\n  operator tailscale/tailscale-operator \\\r\n  --set operatorConfig.logging=debug\n</code></pre>\n<p>If you deployed the operator using <a href=\"https://tailscale.com/docs/features/kubernetes-operator#static-manifests-with-kubectl\">static manifests</a>, you can set <code>OPERATOR_LOGGING</code> environment variable for the operator's <code>Deployment</code> to <code>debug</code>.</p>\n<p>To review the logs, run:</p>\n<pre><code class=\"language-shell\">kubectl logs deployment/operator --namespace tailscale\n</code></pre>\n<h3><a href=\"https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#proxy-logs-and-events\">Proxy logs and events</a></h3>\n<p>To get logs and events for the proxy created for an <a href=\"https://tailscale.com/docs/features/kubernetes-operator/how-to/cluster-ingress#ingress-resource\"><code>Ingress</code></a> resource, run:</p>\n<pre><code class=\"language-shell\">pod_name=$(kubectl get pod --selector=tailscale.com/parent-resource-type=ingress,tailscale.com/parent-resource=&#x3C;ingress-name>,tailscale.com/parent-resource-ns=&#x3C;ingress-namespace> \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl logs ${pod_name} --namespace tailscale\r\nkubectl describe pod ${pod_name} --namespace tailscale\n</code></pre>\n<p>To get logs and events for a proxy created for an <a href=\"https://tailscale.com/docs/features/kubernetes-operator/how-to/cluster-ingress\">ingress</a> or <a href=\"https://tailscale.com/docs/features/kubernetes-operator/how-to/cluster-egress\">egress</a><code>Service</code>, run:</p>\n<pre><code class=\"language-shell\">pod_name=$(kubectl get pod --selector=tailscale.com/parent-resource-type=svc,tailscale.com/parent-resource=&#x3C;service-name>,tailscale.com/parent-resource-ns=&#x3C;service-namespace> \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl logs ${pod_name} --namespace tailscale\r\nkubectl describe pod ${pod_name} --namespace tailscale\n</code></pre>\n<p>To get logs and events for a proxy created for a <code>Connector</code>, run:</p>\n<pre><code class=\"language-shell\">pod_name=$(kubectl get pod --selector=tailscale.com/parent-resource-type=connector,tailscale.com/parent-resource=&#x3C;connector-name> \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl logs ${pod_name} --namespace tailscale\r\nkubectl describe pod ${pod_name} --namespace tailscale\n</code></pre>\n<p>To get logs and events for a proxy created for a <code>ProxyGroup</code>, run:</p>\n<pre><code class=\"language-shell\">pod_name=$(kubectl get pod --selector=tailscale.com/parent-resource-type=proxygroup,tailscale.com/parent-resource=&#x3C;proxy-group-name> \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl logs ${pod_name} --namespace tailscale\r\nkubectl describe pod ${pod_name} --namespace tailscale\n</code></pre>\n<h2><a href=\"https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#cluster-egresscluster-ingress-proxies\">Cluster egress/cluster ingress proxies</a></h2>\n<p>The proxy pod is deployed in the <code>tailscale</code> namespace, and will have a name of the form <code>ts-&#x3C;annotated-service-name>-&#x3C;random-string></code>.</p>\n<p>If there are issues reaching the external service, verify the proxy pod is properly deployed:</p>\n<ul>\n<li>Review the logs and events of the proxy pods.</li>\n<li>Review the logs of the operator. You can do this by running <code>kubectl logs deploy/operator --namespace tailscale</code>. The log level can be configured using the <code>OPERATOR_LOGGING</code> environment variable in the operator's <a href=\"https://github.com/tailscale/tailscale/blob/main/cmd/k8s-operator/deploy/manifests/operator.yaml\">manifest file</a>.</li>\n<li>Verify that the cluster workload can send traffic to the proxy pod in the <code>tailscale</code> namespace.</li>\n</ul>\n<h2><a href=\"https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#tls-connection-errors\">TLS connection errors</a></h2>\n<p>If you are connecting to a workload exposed to the tailnet over <code>Ingress</code> or to the <code>kube</code> API server over the operator's API server proxy, you can sometimes run into TLS connection errors.</p>\n<p>Check the following, in sequence:</p>\n<ol>\n<li>HTTPS is not enabled for the tailnet.</li>\n</ol>\n<p>To use Tailscale <code>Ingress</code> or API server proxy, you must ensure that <a href=\"https://tailscale.com/docs/how-to/set-up-https-certificates\">HTTPS is enabled for your tailnet</a>.</p>\n<ol start=\"2\">\n<li>Let's Encrypt certificate has not yet been provisioned.</li>\n</ol>\n<p>If HTTPS is enabled, the errors are most likely related to Let's Encrypt certificate provisioning flow.</p>\n<p>For each Tailscale <code>Ingress</code> resource, the operator deploys a Tailscale node that runs a TLS server. This server is provisioned with a Let's Encrypt certificate for the MagicDNS name of the node. For the API server proxy, the operator also runs an in-process TLS server that proxies tailnet traffic to the Kubernetes API server. This server gets provisioned with a Let's Encrypt certificate for the MagicDNS name of the operator.</p>\n<p>In both cases, the certificates are provisioned lazily the first time a client connects to the server. Provisioning takes some time, so you might receive some TLS timeout errors.</p>\n<p>You can examine the logs to follow the certificate provisioning process:</p>\n<p>For API server proxy, review the operator's logs:</p>\n<ul>\n<li>\n<p>For API server proxy, review the <a href=\"https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#operator-logs\">operator logs</a>.</p>\n</li>\n<li>\n<p>For <code>Ingress</code>, review the <a href=\"https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#proxy-logs\">proxy logs</a>.</p>\n</li>\n</ul>\n<p>There is nothing you can currently do to prevent the first client connection sometimes raising an error. Do <a href=\"https://github.com/tailscale/tailscale/issues/new/choose\">reach out</a> if this is causing issues for your workflow.</p>\n<ol>\n<li>You have hit Let's Encrypt rate limits.</li>\n</ol>\n<p>If the connection does not succeed even after first attempt to connect, you should verify that you have not hit <a href=\"https://letsencrypt.org/docs/rate-limits\">Let's Encrypt rate limits</a>. If a limit has been hit, you will be able to find the error returned from Let's Encrypt in the logs.</p>\n<p>We are currently working on making it less likely for users to hit Let's Encrypt rate limits. Refer to related discussion in <a href=\"https://github.com/tailscale/tailscale/issues/11119\"><code>tailscale/tailscale#11119</code></a>.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#oauth-client-and-tagging-issues\">OAuth client and tagging issues</a></h2>\n<p>If you're experiencing issues with the operator not being properly tagged or having permission issues, check the following:</p>\n<ol>\n<li>\n<p><strong>OAuth client scopes</strong>: Ensure your OAuth client has both the <code>devices:core</code> and <code>auth_keys</code> scopes with write permissions.</p>\n</li>\n<li>\n<p><strong>OAuth client tag permissions</strong>: The OAuth client must have permission to use all tags you want to apply to the operator. For example, if your <code>operatorConfig.defaultTags</code> specifies multiple tags like <code>tag:k8s-operator,tag:k8s-test</code>, your OAuth client must have permission to use<code>tag:k8s-operator</code>.</p>\n</li>\n<li>\n<p><strong>Tag ownership in ACL</strong>: Check that your tag ownership is properly configured in your tailnet policy file.</p>\n</li>\n</ol>\n<pre><code class=\"language-json\">\"tagOwners\": {\r\n     \"tag:k8s-operator\": [],\r\n     \"tag:k8s-test\": [\"tag:k8s-operator\"],\r\n}\n</code></pre>\n<ol start=\"4\">\n<li>\n<p><strong>Refresh operator state</strong>:</p>\n<ul>\n<li>\n<p>If you've updated your ACL policy, the changes will be applied automatically and don't require any restart.</p>\n</li>\n<li>\n<p>If you've created a new OAuth client to replace the previous one, you must reinstall the operator completely to ensure a new key is created. Follow the <a href=\"https://tailscale.com/docs/features/kubernetes-operator#setup\">installation instructions</a> again with the new OAuth client credentials.</p>\n</li>\n</ul>\n</li>\n<li>\n<p><strong>Check OAuth client in console</strong>: Verify in the Tailscale admin console that your OAuth client has the exact tags you want to apply to the operator. Remember that each tag's permissions are evaluated independently.</p>\n</li>\n<li>\n<p><strong>Inspect operator logs</strong>: Look for authorization errors or tag-related messages in the <a href=\"https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#operator-logs\">operator logs</a>.</p>\n</li>\n</ol>\n<h2><a href=\"https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator#tailscale-ingress-troubleshooting\">Tailscale Ingress troubleshooting</a></h2>\n<p>This section contains additional information for troubleshooting Tailscale <code>Ingress</code>.</p>\n<ul>\n<li>Check that the operator has configured the ingress proxy correctly:</li>\n</ul>\n<p>For example, if you have a Tailscale <code>Ingress</code> with a backend <code>Service</code> similar to these:</p>\n<pre><code class=\"language-yaml\">apiVersion: networking.k8s.io/v1\r\nkind: Ingress\r\nmetadata:\r\nname: my-app\r\nspec:\r\ningressClassName: tailscale\r\nrules:\r\n- http:\r\n    paths:\r\n    - backend:\r\n        service:\r\n          name: my-app\r\n          port:\r\n            number: 80\r\n      path: /login\r\n      pathType: Prefix\r\ntls:\r\n- hosts:\r\n  - my-app\r\n---\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\nname: my-app\r\nspec:\r\nclusterIP: 192.0.2.9\r\nports:\r\n- port: 80\n</code></pre>\n<ul>\n<li>Validate that the ingress proxy's configuration matches:</li>\n</ul>\n<pre><code class=\"language-shell\">INGRESS_NAME=&#x3C;ingress-resource-name> \\\r\nINGRESS_NAMESPACE=&#x3C;ingress-resource-namespace> \\\r\nsecret_name=$(kubectl get secret --selector=tailscale.com/parent-resource-type=ingress,tailscale.com/parent-resource=${INGRESS_NAME},tailscale.com/parent-resource-ns=${INGRESS_NAMESPACE} \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl get secret ${secret_name} -n tailscale -ojsonpath={.data.serve-config} | base64 -d\r\n'{\"TCP\":{\"443\":{\"HTTPS\":true}},\"Web\":{\"${TS_CERT_DOMAIN}:443\":{\"Handlers\":{\"/login\":{\"Proxy\":\"http://192.0.2.9:80/\"}}}}}'\n</code></pre>\n<p>If the configuration appears to be incorrect, check the operator logs for any errors relating to configuring the <code>Ingress</code>.</p>\n<ul>\n<li>Check that the ingress proxy has loaded the configuration.</li>\n</ul>\n<p>Run the following command to review the current proxy's configuration:</p>\n<pre><code class=\"language-shell\">INGRESS_NAME=&#x3C;ingress-resource-name> \\\r\nINGRESS_NAMESPACE=&#x3C;ingress-resource-namespace> \\\r\npod_name=$(kubectl get pod --selector=tailscale.com/parent-resource-type=ingress,tailscale.com/parent-resource=${INGRESS_NAME},tailscale.com/parent-resource-ns=${INGRESS_NAMESPACE} \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl exec ${pod_name} --namespace tailscale -- tailscale serve status\r\nhttps://my-app.&#x3C;tailnetxyz>.ts.net (tailnet only)\r\n|-- / proxy http://192.0.2.9:80/\n</code></pre>\n<p>If the configuration appears to be incorrect, check the proxy <code>Pod</code>'s logs.</p>\n<ul>\n<li>Verify that the <code>Service</code> backend is reachable from the ingress proxy <code>Pod</code>:</li>\n</ul>\n<pre><code class=\"language-shell\">INGRESS_NAME=&#x3C;ingress-resource-name> \\\r\nINGRESS_NAMESPACE=&#x3C;ingress-resource-namespace> \\\r\npod_name=$(kubectl get pod --selector=tailscale.com/parent-resource-type=ingress,tailscale.com/parent-resource=${INGRESS_NAME},tailscale.com/parent-resource-ns=${INGRESS_NAMESPACE} \\\r\n  --namespace tailscale -ojsonpath='{.items[0].metadata.name}')\r\nkubectl exec -it ${pod_name} -n tailscale -- sh \\\r\napk add curl \\\r\ncurl http://192.0.2.9:80/\n</code></pre>\n<p>If the backend cannot be reached, the issue is likely related to cluster connectivity from <code>tailscale</code> namespace.\r\nVerify that you don't have a <code>NetworkPolicy</code> in place that prevents <code>Pod</code>s in <code>tailscale</code> namespace to talk to the <code>Ingress</code> backend.</p>\n"}