## TL;DR
A leftover `ValidatingWebhookConfiguration` from a previous ingress-nginx install rejects the new install's objects. Delete the stale webhook configuration, then install cleanly. The admission check passes once the orphan is gone.

## Error
```text
ingress-nginx: admission webhook denied the install
```

## Steps
1. List webhook configs: run `kubectl get validatingwebhookconfiguration` and find the ingress-nginx admission one. Expected: a stale config from the old install.
2. Check whether any live controller still needs it: if no ingress-nginx controller pods exist, the webhook is an orphan. Expected: confirmation it is safe to remove.
3. Delete the stale configuration. Expected: the API server no longer consults the dead webhook.
4. Re-run the install (helm upgrade/install). Expected: objects admit cleanly.
5. Verify the new install recreated its own webhook config pointing at the live controller. Expected: admission works for future ingress changes.

## When to use
- ingress-nginx helm install fails with admission webhook denials
- After deleting a release without cleaning webhooks
- Reinstalling a different ingress-nginx version

## When not to use
- Chart value validation errors (helm-side)
- A live webhook rejecting genuinely invalid ingress objects (fix the ingress)

## Tool compatibility
- ingress-nginx helm chart; Kubernetes ValidatingWebhookConfiguration

## Variant phrasings
### helm install ingress nginx webhook error
A previous install's webhook is still registered; delete it and retry.

### admission webhook denies ingress creation
Check whether the webhook's controller is actually running before deleting.

## Why it happens
helm's uninstall does not always remove cluster-scoped webhook configs, and the API server keeps calling the (now dead) webhook endpoint. The dead webhook fails closed, so every new ingress-nginx object is denied until the orphan config is removed.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Ujn9ITKwKYjde8WP-_easg