Introduction

This Helm upgrade error means the rendered Kubernetes Ingress manifest is invalid before the API server accepts it. The key part of the message is that spec.rules[0].http exists, but the required paths field is missing, so validation fails.

What the Error Actually Means

In a networking.k8s.io/v1 Ingress, an HTTP rule cannot just declare http: without a list of routing paths underneath it. A broken manifest often looks like this:

1apiVersion: networking.k8s.io/v1
2kind: Ingress
3metadata:
4  name: demo
5spec:
6  rules:
7    - host: demo.local
8      http: {}

Kubernetes rejects that because paths is required under the HTTP rule.

The minimal valid shape is:

1apiVersion: networking.k8s.io/v1
2kind: Ingress
3metadata:
4  name: demo
5spec:
6  rules:
7    - host: demo.local
8      http:
9        paths:
10          - path: /
11            pathType: Prefix
12            backend:
13              service:
14                name: demo-service
15                port:
16                  number: 80

Once the manifest contains a real paths list, the specific validation error goes away.

Why Helm Charts Trigger This So Often

With Helm, the problem is usually not the Kubernetes schema itself. It is that the template renders invalid YAML because values are empty or conditionals are incomplete.

Typical failure pattern:

• 'ingress.enabled is true'
• the template emits http:
• '.Values.ingress.paths is empty or missing'

That creates an Ingress rule that looks syntactically plausible but is structurally invalid for the Kubernetes API.

A Safer Helm Template Pattern

Your chart should either require at least one path or skip rendering the Ingress entirely when no valid paths are supplied.

1{{- if and .Values.ingress.enabled .Values.ingress.paths }}
2apiVersion: networking.k8s.io/v1
3kind: Ingress
4metadata:
5  name: {{ include "demo.fullname" . }}
6spec:
7  rules:
8    - host: {{ .Values.ingress.host | quote }}
9      http:
10        paths:
11{{- range .Values.ingress.paths }}
12          - path: {{ .path | quote }}
13            pathType: {{ .pathType | quote }}
14            backend:
15              service:
16                name: {{ $.Values.service.name }}
17                port:
18                  number: {{ $.Values.service.port }}
19{{- end }}
20{{- end }}

This makes the chart fail less mysteriously because it avoids rendering a partial HTTP block with missing required fields.

Debug the Rendered Manifest, Not Just the Template

The fastest way to diagnose Helm validation problems is to inspect exactly what Helm rendered.

helm template demo ./chart -f values.yaml > rendered.yaml
kubectl apply --dry-run=server -f rendered.yaml

That gives you the real manifest Kubernetes is validating. If paths is missing there, the bug is in the template logic or values file, not in the upgrade mechanism itself.

For a live release, helm upgrade --dry-run --debug is also useful because it shows rendered resources and values resolution in one place.

Version-Specific Ingress Details

When using networking.k8s.io/v1, each path entry also needs:

• 'path'
• 'pathType'
• 'backend.service.name'
• 'backend.service.port'

Old blog posts may still show older Ingress API shapes. Mixing those examples with a modern cluster often produces confusing validation failures that look unrelated at first glance.

So if you see a missing-paths error, also verify the rest of the Ingress schema version is correct.

Common Pitfalls

Rendering http: while forgetting to render a non-empty paths list underneath it is the core mistake.

Assuming the Helm template is correct without checking the rendered YAML wastes time because Kubernetes validates the rendered manifest, not your template intent.

Copying examples from older Ingress API versions can introduce missing or misplaced fields in networking.k8s.io/v1.

Incorrect YAML indentation in Helm templates can push paths to the wrong level even when the values are present.

Summary

• The error means the rendered Ingress HTTP rule is missing the required paths field.
• In Helm charts, this usually happens because values or conditionals produce a partial HTTP block.
• Render the manifest with helm template and validate that output directly.
• For networking.k8s.io/v1, make sure the full path entry shape is current, including pathType.
• The fix is in the rendered Ingress structure, not in Helm upgrade itself.