How to fix Failed to read from server connection=&discovery.Typha in Kubernetes

KubernetesADVANCEDHIGHUpdated Dec 6, 2025· 137 views

Typha synchronization errors occur when calico-node cannot connect to Typha service. Common causes include service discovery failures, TLS certificate issues, and network connectivity problems.

Quick fix

Fixes Failed to read from server connection=&discovery.Typha

kubectl get deployment -n calico-system calico-typha
kubectl get endpoints -n calico-system calico-typha
kubectl describe svc calico-typha -n calico-system
  1. Check Typha deployment status
  2. Check Typha pod logs for errors
  3. Verify network connectivity to Typha
  4. Check for network policies blocking Typha access
kubernetes — error
kubectl get deployment -n calico-system calico-typha
kubectl get endpoints -n calico-system calico-typha
kubectl describe svc calico-typha -n calico-system
Failed to read from server connection=&discovery.Typha

What this error means

Typha is Calico's intermediate data store that syncs API server state to all calico-node instances. When calico-node cannot connect to Typha, it cannot receive policy and network configuration updates, leaving the node unable to properly enforce network policies and route traffic.

Typical symptoms

  • Error message "Failed to read from server connection=&discovery.Typha"
  • Calico node pod shows "Kubernetes service missing IP or port"
  • calico-node pods not ready or failing readiness probe
  • Connection timeout errors to Typha on port 5473
  • TLS certificate verification failures in logs
  • All calico-node pods down when all Typha pods are down
  • Network policies not updating on nodes
  • Service discovery failures with timeout exceptions

Common causes

  1. Typha service not properly configured or unavailable
  2. Network connectivity blocked between nodes and Typha (firewall, NetworkPolicy)
  3. TLS certificate issues or certificate mismatch
  4. Kubernetes API server connectivity timeout
  5. Typha replicas scaled down or not running
  6. Incorrect Typha service endpoint configuration
  7. High latency on network causing timeouts
  8. DNS resolution failing for Typha service

How to fix "Failed to read from server connection=&discovery.Typha"

1Check Typha deployment status

Verify Typha is running and has endpoints:

bash
kubectl get deployment -n calico-system calico-typha
kubectl get endpoints -n calico-system calico-typha
kubectl describe svc calico-typha -n calico-system
2Check Typha pod logs for errors

Review Typha logs for configuration or startup issues:

bash
kubectl logs -n calico-system -l app=calico-typha --tail=50

Look for certificate errors, API server connectivity issues, or port conflicts.

3Verify network connectivity to Typha

From a calico-node pod, test connectivity to Typha:

bash
kubectl exec -it -n calico-system ds/calico-node -- \
  nc -zv calico-typha.calico-system.svc.cluster.local 5473

If connection fails, check firewall and network policies.

4Check for network policies blocking Typha access

Ensure network policies allow calico-node to reach Typha:

bash
calicoctl get networkpolicy -o yaml | grep -A 10 "to:"

Allow port 5473 from kube-system namespace to calico-system.

5Verify TLS certificate configuration

Check certificate-related secrets and ConfigMaps:

bash
kubectl get secret -n calico-system | grep -i tls
kubectl get configmap -n calico-system calico-config -o yaml

Verify certificate paths and CA bundles are correct.

6Check Kubernetes API server connectivity

Typha needs to query the API server. Verify connectivity:

bash
kubectl exec -it -n calico-system deployment/calico-typha -- \
  curl -k https://kubernetes.default.svc.cluster.local:443
7Increase Typha replicas if using single pod

Ensure Typha has enough replicas for redundancy:

bash
kubectl scale deployment -n calico-system calico-typha --replicas=3
kubectl rollout status deployment/calico-typha -n calico-system
8Restart Calico Typha and node daemonsets

Force full restart to reconnect:

bash
kubectl rollout restart deployment/calico-typha -n calico-system
kubectl rollout restart daemonset/calico-node -n calico-system
kubectl rollout status daemonset/calico-node -n calico-system

Advanced notes

For production, run Typha with multiple replicas (minimum 3) and ensure they are spread across different nodes. Monitor Typha pod status continuously. For large clusters (100+ nodes), Typha reduces load on the API server significantly. Ensure TLS certificates used by Typha are not in rotation workflows that could cause immediate disconnections. Set connection timeout thresholds appropriately for your network latency characteristics.

Frequently asked questions

What does "Failed to read from server connection=&discovery.Typha" mean?
Typha is Calico's intermediate data store that syncs API server state to all calico-node instances. When calico-node cannot connect to Typha, it cannot receive policy and network configuration updates, leaving the node unable to properly enforce network policies and route traffic.
How do I fix "Failed to read from server connection=&discovery.Typha"?
Typha synchronization errors occur when calico-node cannot connect to Typha service. Common causes include service discovery failures, TLS certificate issues, and network connectivity problems.
What causes "Failed to read from server connection=&discovery.Typha"?
Typha service not properly configured or unavailable Network connectivity blocked between nodes and Typha (firewall, NetworkPolicy) TLS certificate issues or certificate mismatch
Is the "Failed to read from server connection=&discovery.Typha" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading