You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When an error is returned, kubewebhook returns error 500 with the JSON-encoded AdmissionReview response object. However, Kubernetes doesn't actually decode this response body, it just displays an error like this when failurePolicy: Fail:
Error from server (InternalError): Internal error occurred: failed calling webhook "example.com": an error on the server ("{\"kind\":\"AdmissionReview\",\"apiVersion\":\"admission.k8s.io/v1\",\"response\":{\"uid\":\"00000000-0000-0000-0000-000000000000\",\"allowed\":false,\"status\":{\"metadata\":{},\"status\":\"Failure\",\"message\":\"validator error: {actual error string from user}\"}}}") has prevented the request from succeeding
(and when failurePolicy: Ignore, it assumes the webhook is allowed, which is expected)
This is a bit misleading to users. A hurried new user to webhooks may skim through the Kubernetes docs on webhooks and see that an AdmissionReview response should be returned, and then assume that returning an error results in a rejection based on how the above error message looks like (because it resembles an actual rejection).
Why do we need to encode the error into a JSON object when the apiserver doesn't really handle it?
The text was updated successfully, but these errors were encountered:
When an error is returned, kubewebhook returns error 500 with the JSON-encoded AdmissionReview response object. However, Kubernetes doesn't actually decode this response body, it just displays an error like this when
failurePolicy: Fail
:(and when
failurePolicy: Ignore
, it assumes the webhook is allowed, which is expected)This is a bit misleading to users. A hurried new user to webhooks may skim through the Kubernetes docs on webhooks and see that an
AdmissionReview
response should be returned, and then assume that returning an error results in a rejection based on how the above error message looks like (because it resembles an actual rejection).Why do we need to encode the error into a JSON object when the apiserver doesn't really handle it?
The text was updated successfully, but these errors were encountered: