How to temporarily disable KIC Admission Controller

While troubleshooting we might be interested to temporarily disable Kubernetes Ingress Controller Admission Controller. Or in some situations where we get errors connecting the validation service:

kubectl apply -f repro.yaml 
Error from server (InternalError): error when creating "repro.yaml": Internal error occurred: failed calling webhook "validations.kong.konghq.com": Post "https://kong-kong-validation-webhook.kong.svc:443/?timeout=10s": service "kong-kong-validation-webhook" not found

To temporarily disable the Admission Controller, for testing and troubleshooting, you can run these commands in your K8s cluster to:

1. Get the current kong-kong-validations configuration and save it to a file, kong-validations.yaml:

   kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io kong-kong-validations -o yaml > kong-validations.yaml

   Copied!

2. Delete the kong-kong-validations webhook configuration:

   kubectl delete validatingwebhookconfigurations.admissionregistration.k8s.io kong-kong-validations

   Copied!

To enable the Admission Controller again you can recover from the file created in previous step:

kubectl apply -f kong-validations.yaml

Note: this only fully disables admission control if the deleted ValidatingWebhookConfiguration is the only Kong-related one in the cluster. Kubernetes invokes every ValidatingWebhookConfiguration that matches a given resource, not just the one belonging to a particular KIC release. If there is more than one KIC installation in the cluster, each with its own webhook configuration, you must delete all of the matching webhook configurations to actually let an otherwise-invalid config through - deleting just one release’s configuration will not do it, since the others will still intercept the request.

More information about the Admission Controller can be found in the Admission Controller documentation.