Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error message should be returned directly as plaintext upon error #188

Open
SOF3 opened this issue Jun 8, 2022 · 0 comments
Open

Error message should be returned directly as plaintext upon error #188

SOF3 opened this issue Jun 8, 2022 · 0 comments

Comments

@SOF3
Copy link

SOF3 commented Jun 8, 2022

When an error is returned, kubewebhook returns error 500 with the JSON-encoded AdmissionReview response object. However, Kubernetes doesn't actually decode this response body, it just displays an error like this when failurePolicy: Fail:

Error from server (InternalError): Internal error occurred: failed calling webhook "example.com": an error on the server ("{\"kind\":\"AdmissionReview\",\"apiVersion\":\"admission.k8s.io/v1\",\"response\":{\"uid\":\"00000000-0000-0000-0000-000000000000\",\"allowed\":false,\"status\":{\"metadata\":{},\"status\":\"Failure\",\"message\":\"validator error: {actual error string from user}\"}}}") has prevented the request from succeeding

(and when failurePolicy: Ignore, it assumes the webhook is allowed, which is expected)

This is a bit misleading to users. A hurried new user to webhooks may skim through the Kubernetes docs on webhooks and see that an AdmissionReview response should be returned, and then assume that returning an error results in a rejection based on how the above error message looks like (because it resembles an actual rejection).

Why do we need to encode the error into a JSON object when the apiserver doesn't really handle it?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant