NGINX Ingress admission webhook "denied the request" in CI

By Daniel Zoghalchali·Latchkey

kubectl apply was blocked by the ingress-nginx validating admission webhook. The controller test-rendered the Ingress into nginx config, the render failed nginx validation, and the webhook denied the apply.

What this error means

kubectl apply fails with "admission webhook \"validate.nginx.ingress.kubernetes.io\" denied the request" and an nginx error explaining what is invalid.

Error from server (BadRequest): admission webhook "validate.nginx.ingress.kubernetes.io"
denied the request: nginx.conf test failed

Common causes

The Ingress renders to invalid nginx config

A snippet, rewrite, or regex in the Ingress produces config that fails nginx -t, so the webhook rejects it.

A conflicting or duplicate host/path

Overlapping rules render to a config nginx cannot accept, and the webhook blocks the apply.

How to fix it

Read the nginx error in the denial

1. Read the webhook message; it includes the nginx test failure reason.
2. Fix the annotation, rewrite, or path that produced invalid config.
3. Re-apply once the rendered config would pass nginx -t.

kubectl apply -f ingress.yaml

Validate before apply with a dry run

Run a server-side dry run so the webhook validates in CI without changing cluster state.

kubectl apply --dry-run=server -f ingress.yaml

How to prevent it

• Use --dry-run=server in CI to trigger webhook validation early.
• Keep rewrite and snippet annotations simple and reviewed.
• Avoid overlapping host/path rules across Ingress objects.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation