Learn how to fix the failed calling “webhook validate.nginx.ingress.kubernetes.io” error. Our Nginx Support team is here to help you with your questions and concerns.

Failed calling webhook validate.nginx.ingress.kubernetes.io

Anyone who has dealt with Kubernetes knows that managing ingress controllers is key to routing external traffic to services within the cluster.

However, even seasoned Kubernetes administrators run into errors. Today, our experts are going to take us through troubleshooting and resolving ingress controller webhook errors.

Recently, one of our customers ran into trouble while creating a non-nginx ingress after deploying an nginx ingress instance for RTF BYOK Self-Managed Kubernetes.

Error from server (InternalError): error when creating “my-ingress.yaml”: Internal error occurred: failed calling webhook “validate.nginx.ingress.kubernetes.io”: Post https://ingress-nginx-controller-admission.ingress-nginx.svc:443/extensions/v1beta1/ingresses?timeout=30s: context deadline exceeded

After taking a closer look, it seems that a webhook associated with the nginx ingress, which gets invoked during ingress actions, was still lingering even though the nginx ingress deployment was removed. Hence, this webhook was causing interference that led to the error.

Fortunately, we can easily fix this via one of these options:

1. Removing the Nginx Ingress Webhook:

   We can delete the nginx ingress webhook with this command:

   kubectl delete -A ValidatingWebhookConfiguration ingress-nginx-admission


   Alternatively, we can remove the entire Validating Webhook. Although a workaround, it removes the interference due to the residual nginx ingress webhook.
2. Configuring Firewall Rules (for Private GKE Clusters):

   In cases where Kubernetes clusters are hosted on platforms like Google Kubernetes Engine (GKE) and utilizing private clusters, we need to take additional steps.

   By configuring firewall rules we can allow inbound TCP requests to the master node at port 8443. This will resolve the issue. This step makes sure that the nodes within the cluster can reach the master for the validating webhook API.

   Here are the steps to create the rule:

   1. First, go to Firewall Rules and add a new one.
   2. Then, go to Network and choose the VPC that the cluster belongs to.
   3. Next, set Direction of traffic to Ingress, Action on match to Allow, and Targets to Specified target tags.
   4. Open a new window, go to cluster node pools and here we will find the master node pool. Once we enter one of the nodes, we will see the Virtual Machine details. We can copy the Network Tags value from here and add it to the Firewall Rule form.

      Additionally, we can find the Target tags option on the master node under Network tags.
   5. Then, enable Specified protocols and ports under Protocols and ports.
   6. After that, add 8443 as the TCP.
   7. Finally, save the rule and apply the manifest again.

Let us know in the comments if you need further help with the “ failed calling webhook validate.nginx.ingress.kubernetes.io” error.

[Need assistance with a different issue? Our team is available 24/7.]

Conclusion

In brief, our Support Experts demonstrated how to fix the “ failed calling webhook validate.nginx.ingress.kubernetes.io” error.