Ingress New Added 29 September 2026

ingress-nginx: host "example.com" and path "/" is already defined in ingress

The admission webhook rejected the Ingress because another Ingress, possibly in a different namespace, already claims exactly the same host and path. ingress-nginx merges every Ingress into one nginx config, so two owners for one location would be ambiguous. It often catches out a blue and green deploy or a Helm release that was renamed while the old one still exists.

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

Quick fix

# Find every Ingress that claims the host, across all namespaces
kubectl get ingress -A -o wide | grep example.com

# Show the paths each one defines
kubectl get ingress -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.rules[*].host} {.spec.rules[*].http.paths[*].path}{"\n"}{end}'

# Remove the stale owner, usually an old release
kubectl -n old-namespace delete ingress old-app

# Or give each Ingress a distinct path under the same host
#   app-a: /api    app-b: /web

# Then apply again
kubectl apply -f ingress.yaml

How to diagnose Ingress errors

An Ingress failure is a routing failure, and there are only a few places it can break: the IngressClass is missing so no controller claims the resource, the path or host does not match, the backing Service has no endpoints, or the TLS secret is absent or in the wrong namespace. The "default backend - 404" page is the controller saying it received the request but found no rule for it.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

Work backwards from the pod: kubectl get endpoints <service>. If it is empty, the Service selector does not match any ready pod and no Ingress configuration will help.
Check that a controller has claimed the Ingress: kubectl describe ingress <name> should show events and an assigned address. No address means no controller is watching that IngressClass.
Read the controller's own logs (kubectl logs -n ingress-nginx deploy/ingress-nginx-controller). They log rejected configuration and certificate problems explicitly.
Remember TLS secrets must live in the same namespace as the Ingress. This is the single most common TLS mistake.
Verify path type semantics: Prefix, Exact and ImplementationSpecific match differently, and regex behaviour varies between controllers.

Tools worth reaching for

kubectl describe ingress
kubectl get endpoints
controller logs
curl -H 'Host: …'
openssl s_client -servername

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

kubernetes.github.io kubernetes.github.io

Related Ingress errors

See all 20 Ingress errors →

Browse other categories

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.