From 69330315577f78eac0da8ef5fdffed79327080f8 Mon Sep 17 00:00:00 2001
From: Becky Pauley <becky@tailscale.com>
Date: Fri, 28 Aug 2026 18:56:43 +0100
Subject: [PATCH] update egress-readiness to ignore stale endpointslices

---
 cmd/k8s-operator/egress-services-readiness.go | 34 +++++++++++--------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/cmd/k8s-operator/egress-services-readiness.go b/cmd/k8s-operator/egress-services-readiness.go
index d2e05adc5..c051dced1 100644
--- a/cmd/k8s-operator/egress-services-readiness.go
+++ b/cmd/k8s-operator/egress-services-readiness.go
@@ -74,20 +74,6 @@ func (esrr *egressSvcsReadinessReconciler) Reconcile(ctx context.Context, req re
 	}()
 
 	crl := egressSvcChildResourceLabels(svc)
-	epsList := &discoveryv1.EndpointSliceList{}
-	if err = esrr.List(ctx, epsList, client.InNamespace(esrr.tsNamespace), client.MatchingLabels(crl)); err != nil {
-		err = fmt.Errorf("error listing EndpointSlices: %w", err)
-		reason = reasonReadinessCheckFailed
-		msg = err.Error()
-		return res, err
-	}
-	if len(epsList.Items) == 0 {
-		lg.Infof("EndpointSlices for Service do not yet exist, waiting...")
-		reason, msg = reasonClusterResourcesNotReady, reasonClusterResourcesNotReady
-		st = metav1.ConditionFalse
-		return res, nil
-	}
-	// If an EndpointSlice for an expected family is missing, we mark the Service as NotReady.
 	clusterIPSvc, err := getSingleObject[corev1.Service](ctx, esrr.Client, esrr.tsNamespace, crl)
 	if err != nil {
 		err = fmt.Errorf("error retrieving ClusterIP Service: %w", err)
@@ -101,6 +87,26 @@ func (esrr *egressSvcsReadinessReconciler) Reconcile(ctx context.Context, req re
 		st = metav1.ConditionFalse
 		return res, nil
 	}
+	// EndpointSlice list can also contain orphans (e.g. if an ExternalName Service's ProxyGroup is edited in place).
+	// We don't support editing ProxyGroup on ExternalName Services, but should guard against this case.
+	// We use the current ClusterIP Service's name to filter those out, mirroring the orphan guard in the egress EndpointSlices
+	// reconciler. Otherwise, an orphan slice could block the readiness condition.
+	epsList := &discoveryv1.EndpointSliceList{}
+	if err = esrr.List(ctx, epsList, client.InNamespace(esrr.tsNamespace), client.MatchingLabels(crl)); err != nil {
+		err = fmt.Errorf("error listing EndpointSlices: %w", err)
+		reason = reasonReadinessCheckFailed
+		msg = err.Error()
+		return res, err
+	}
+	epsList.Items = slices.DeleteFunc(epsList.Items, func(eps discoveryv1.EndpointSlice) bool {
+		return eps.Labels[discoveryv1.LabelServiceName] != clusterIPSvc.Name
+	})
+	if len(epsList.Items) == 0 {
+		lg.Infof("EndpointSlices for Service do not yet exist, waiting...")
+		reason, msg = reasonClusterResourcesNotReady, reasonClusterResourcesNotReady
+		st = metav1.ConditionFalse
+		return res, nil
+	}
 	gotAddrTypes := make(set.Set[discoveryv1.AddressType], len(epsList.Items))
 	for _, eps := range epsList.Items {
 		gotAddrTypes.Add(eps.AddressType)