ingress-nginx: admission webhook denied the install

TL;DR

A leftover ValidatingWebhookConfiguration from a previous ingress-nginx install rejects the new install's objects. Delete the stale webhook configuration, then install cleanly. The admission check passes once the orphan is gone.

Error

ingress-nginx: admission webhook denied the install

Steps

1. List webhook configs: run kubectl get validatingwebhookconfiguration and find the ingress-nginx admission one. Expected: a stale config from the old install.
2. Check whether any live controller still needs it: if no ingress-nginx controller pods exist, the webhook is an orphan. Expected: confirmation it is safe to remove.
3. Delete the stale configuration. Expected: the API server no longer consults the dead webhook.
4. Re-run the install (helm upgrade/install). Expected: objects admit cleanly.
5. Verify the new install recreated its own webhook config pointing at the live controller. Expected: admission works for future ingress changes.

When to use

• ingress-nginx helm install fails with admission webhook denials
• After deleting a release without cleaning webhooks
• Reinstalling a different ingress-nginx version

When not to use

• Chart value validation errors (helm-side)
• A live webhook rejecting genuinely invalid ingress objects (fix the ingress)

Tool compatibility

• ingress-nginx helm chart; Kubernetes ValidatingWebhookConfiguration

Variant phrasings

helm install ingress nginx webhook error

A previous install's webhook is still registered; delete it and retry.

admission webhook denies ingress creation

Check whether the webhook's controller is actually running before deleting.

Why it happens

helm's uninstall does not always remove cluster-scoped webhook configs, and the API server keeps calling the (now dead) webhook endpoint. The dead webhook fails closed, so every new ingress-nginx object is denied until the orphan config is removed.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstUjn9ITKwKYjde8WP-easg