ingress-nginx: failed calling webhook "validate.nginx.ingress.kubernetes.io"
The API server tried to ask the ingress-nginx admission webhook whether your Ingress is valid and could not reach it at all, so nothing about your manifest has been judged yet. It usually means the controller pod is not running, a NetworkPolicy or private cluster firewall blocks the control plane from reaching port 8443, or a leftover ValidatingWebhookConfiguration points at a controller that was uninstalled.
Quick fix
Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.
# Is there a webhook configuration, and which service does it call?
kubectl get validatingwebhookconfigurations
kubectl get validatingwebhookconfiguration ingress-nginx-admission -o yaml | grep -A4 service:
# Does that service exist and have a ready endpoint behind it?
kubectl -n ingress-nginx get svc ingress-nginx-controller-admission
kubectl -n ingress-nginx get endpointslices
kubectl -n ingress-nginx get pods -l app.kubernetes.io/component=controller
# Private GKE and similar: allow the control plane to reach the nodes on 8443
# gcloud compute firewall-rules create allow-ingress-webhook --allow tcp:8443 ...
# Controller long gone? Remove the orphaned webhook it left behind
kubectl delete validatingwebhookconfiguration ingress-nginx-admissionHow to diagnose Ingress errors
An Ingress failure is a routing failure, and there are only a few places it can break: the IngressClass is missing so no controller claims the resource, the path or host does not match, the backing Service has no endpoints, or the TLS secret is absent or in the wrong namespace. The "default backend - 404" page is the controller saying it received the request but found no rule for it.
If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.
- Work backwards from the pod:
kubectl get endpoints <service>. If it is empty, the Service selector does not match any ready pod and no Ingress configuration will help. - Check that a controller has claimed the Ingress:
kubectl describe ingress <name>should show events and an assigned address. No address means no controller is watching that IngressClass. - Read the controller's own logs (
kubectl logs -n ingress-nginx deploy/ingress-nginx-controller). They log rejected configuration and certificate problems explicitly. - Remember TLS secrets must live in the same namespace as the Ingress. This is the single most common TLS mistake.
- Verify path type semantics:
Prefix,ExactandImplementationSpecificmatch differently, and regex behaviour varies between controllers.
Tools worth reaching for
kubectl describe ingresskubectl get endpointscontroller logscurl -H 'Host: …'openssl s_client -servername
Authoritative references
Primary documentation for this error, worth reading before applying any fix in production.
Related Ingress errors
- AWS Load Balancer Controller: couldn't auto-discover subnetsThe controller builds an ALB by finding subnets tagged for load balancers, and none in the…
- cert-manager: Failed to determine a valid solver configurationNone of the solvers on the Issuer matches the domains being requested, so cert-manager has no…
- cert-manager: Order is pending / challenge failed to propagatecert-manager created an ACME order but the challenge never validated. For HTTP-01 the…
- Gateway API: HTTPRoute Accepted=False, reason NoMatchingParentThe HTTPRoute names a Gateway in parentRefs, but no listener on that Gateway will take it, so…
- ingress-nginx: 400 The plain HTTP request was sent to HTTPS portThe controller is speaking plain HTTP to a backend that only accepts HTTPS, and the backend's…
- ingress-nginx: host "example.com" and path "/" is already defined in ingressThe admission webhook rejected the Ingress because another Ingress, possibly in a different…
- ingress-nginx: Service does not have any active EndpointThe controller resolved the Ingress to a Service but the Service selects no ready Pods, so it…
- ingress-nginx: upstream timed out (110: Connection timed out)The controller gave up waiting for the backend and returned 504 after its own timeout, which…
Browse other categories
- HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
- JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
- Database 41Connections, deadlocks, constraints, replication and memory limits.
- AI 35Rate limits, context windows, GPU memory and model-serving failures.
- Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
- Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
- Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
- Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
- System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
- Cloud 25IAM permissions, quotas, service limits and credential failures.
- Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
- TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
Something missing or wrong?
This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.