Ingress New Added 9 October 2026

Ingress: spec.rules[0].http.paths[0].pathType: Required value

networking.k8s.io/v1 made pathType mandatory on every path, where the old v1beta1 API filled it in for you. Manifests and Helm charts converted by changing only the apiVersion fail validation here, and usually on the backend fields next, since those changed shape too. The choice matters: Prefix matches whole path segments, Exact matches the string, and ImplementationSpecific leaves it to the controller.

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

Quick fix

# Server-side validation lists every problem at once
kubectl apply --dry-run=server -f ingress.yaml

# v1 path: pathType plus the new backend shape
spec:
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web
            port:
              number: 80

# Regex paths on ingress-nginx need pathType: ImplementationSpecific

How to diagnose Ingress errors

An Ingress failure is a routing failure, and there are only a few places it can break: the IngressClass is missing so no controller claims the resource, the path or host does not match, the backing Service has no endpoints, or the TLS secret is absent or in the wrong namespace. The "default backend - 404" page is the controller saying it received the request but found no rule for it.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

Work backwards from the pod: kubectl get endpoints <service>. If it is empty, the Service selector does not match any ready pod and no Ingress configuration will help.
Check that a controller has claimed the Ingress: kubectl describe ingress <name> should show events and an assigned address. No address means no controller is watching that IngressClass.
Read the controller's own logs (kubectl logs -n ingress-nginx deploy/ingress-nginx-controller). They log rejected configuration and certificate problems explicitly.
Remember TLS secrets must live in the same namespace as the Ingress. This is the single most common TLS mistake.
Verify path type semantics: Prefix, Exact and ImplementationSpecific match differently, and regex behaviour varies between controllers.

Tools worth reaching for

kubectl describe ingress
kubectl get endpoints
controller logs
curl -H 'Host: …'
openssl s_client -servername

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

kubernetes.io kubernetes.io

Related Ingress errors

See all 20 Ingress errors →

Browse other categories

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.