Kubernetes, the open-source container orchestration platform, offers a robust and extensible Admission Controller mechanism that validates or mutates requests to the Kubernetes API server. One of the common scenarios for admission messagem, "denied the request: rejecting admission review because the request does not contain an Ingress resource but networking.k8s.io/v1," may arise due to specific configurations and expectations around resource types and API versions.

Understanding Kubernetes Admission Controllers

Admission controllers are plugins that intercept requests to the Kubernetes API server before the persistence of objects, allowing for various control actions.

1. Validation: Ensure that requests conform to security or business policy guidelines.
2. Mutation: Modify requests to conform to best practices or add default values.

Ingress Resources in Kubernetes

Ingress resources are used in Kubernetes to expose HTTP and HTTPS routes from outside the cluster to services within the cluster. They are defined using the `networking.k8s.io` API group and have been often configured through multiple API versions over the years. This API group allows external HTTP and HTTPS traffic to access services and provides features such as SSL termination and host or path-based routing.

The Issue: "Denied the Request"

The message "denied the request: rejecting admission review because the request does not contain an Ingress resource but networking.k8s.io/v1" generally points to a mismatch of resource kind expected by a Custom Admission Controller during an `AdmissionReview` process.

Possible Causes

1. Incorrect Resource Kind: The Admission Controller might be explicitly configured to handle only `Ingress` resources, but the incoming request might be for another kind of resource within the same API version, like `NetworkPolicy`.
2. API Version Expectation: While the API version `networking.k8s.io/v1` harmonizes various network-related resources, a discrepancy between an expected specific version and the incoming request's version can lead to rejections.
3. Configuration Errors in Controllers: The filter or validation logic in custom controllers or webhook configurations might be incorrectly set to trigger rejections for legitimate requests.

Technical Explanation

In a typical scenario, you may configure a Validating or Mutating Webhook to act on `Ingress` resources. Here's a simple example configuration:

• name: validate.ingress.example.com
  • operations: ["CREATE"]