How to fix Failed to read from server connection=&discovery.Typha in Kubernetes

KubernetesADVANCEDHIGH

Typha synchronization errors occur when calico-node cannot connect to Typha service. Common causes include service discovery failures, TLS certificate issues, and network connectivity problems.

What this error means

Typha is Calico's intermediate data store that syncs API server state to all calico-node instances. When calico-node cannot connect to Typha, it cannot receive policy and network configuration updates, leaving the node unable to properly enforce network policies and route traffic.

Typical symptoms

How to fix "Failed to read from server connection=&discovery.Typha"

1Check Typha deployment status

Verify Typha is running and has endpoints:

bash

kubectl get deployment -n calico-system calico-typha
kubectl get endpoints -n calico-system calico-typha
kubectl describe svc calico-typha -n calico-system

2Check Typha pod logs for errors

Review Typha logs for configuration or startup issues:

bash

kubectl logs -n calico-system -l app=calico-typha --tail=50

Look for certificate errors, API server connectivity issues, or port conflicts.

3Verify network connectivity to Typha

From a calico-node pod, test connectivity to Typha:

bash

kubectl exec -it -n calico-system ds/calico-node -- \
  nc -zv calico-typha.calico-system.svc.cluster.local 5473

If connection fails, check firewall and network policies.

4Check for network policies blocking Typha access

Ensure network policies allow calico-node to reach Typha:

bash

calicoctl get networkpolicy -o yaml | grep -A 10 "to:"

Allow port 5473 from kube-system namespace to calico-system.

5Verify TLS certificate configuration

Check certificate-related secrets and ConfigMaps:

bash

kubectl get secret -n calico-system | grep -i tls
kubectl get configmap -n calico-system calico-config -o yaml

Verify certificate paths and CA bundles are correct.

6Check Kubernetes API server connectivity

Typha needs to query the API server. Verify connectivity:

bash

kubectl exec -it -n calico-system deployment/calico-typha -- \
  curl -k https://kubernetes.default.svc.cluster.local:443

7Increase Typha replicas if using single pod

Ensure Typha has enough replicas for redundancy:

bash

kubectl scale deployment -n calico-system calico-typha --replicas=3
kubectl rollout status deployment/calico-typha -n calico-system

8Restart Calico Typha and node daemonsets

Force full restart to reconnect:

bash

kubectl rollout restart deployment/calico-typha -n calico-system
kubectl rollout restart daemonset/calico-node -n calico-system
kubectl rollout status daemonset/calico-node -n calico-system

How to fix Failed to read from server connection=&discovery.Typha in Kubernetes

What this error means

Typical symptoms

Common causes

How to fix "Failed to read from server connection=&discovery.Typha"

Advanced notes

Related errors

Official resources & further reading