How do I debug a validating admission webhook?

[Matt Reynolds]

I have a validating admission webhook service running in my cluster, a config created for it but it doesn't get called when I add a new resource (ingress). 

I tried posting about this in stack overflow here: https://stackoverflow.com/questions/50767495/how-do-i-debug-a-kubernetes-validating-admission-webhook

here's the configuration object:

    apiVersion: admissionregistration.k8s.io/v1beta1

    kind: ValidatingWebhookConfiguration

    metadata:

      name: ingress-check-webhook-cfg

    webhooks:

      - name: ingress.check.webhook

        rules:

          - apiGroups:

              - extensions

            apiVersions:

              - v1

            operations:

              - CREATE

              - UPDATE

            resources:

              - ingresses

        failurePolicy: Ignore

        clientConfig:

          service:

            name: ingress-check-webhook-svc

            namespace: operations

            path: "/validate"

          caBundle: <cert stuff>

I can curl -k https://ingress-check-webhook-svc.operations/validate within the cluster and see log entries in my webhook service but nothing when I create an ingress. 

my kube-apiserver has --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,Initializers

when I look at the logs for the apiserver it looks like just access logs and I can't find anything logging admission workflow so I'm not sure where to go to figure out why it's not working.

--
cheers,

Matt

[Daniel Smith]

Ingress appears to be a v1beta1 resource: https://kubernetes.io/docs/reference/federation/v1/definitions/

--
You received this message because you are subscribed to the Google Groups "Kubernetes user discussion and Q&A" group.
To unsubscribe from this group and stop receiving emails from it, send an email to kubernetes-use...@googlegroups.com.
To post to this group, send email to kubernet...@googlegroups.com.
Visit this group at https://groups.google.com/group/kubernetes-users.
For more options, visit https://groups.google.com/d/optout.

[Matt Reynolds]

Thanks Daniel - I switched to v1beta1 for apiVersions but I still get the same result.

[Matt Reynolds]

I deleted and re-applied my config and it's working now - I'm guessing I messed up the prior change for the api version change.