How can I test a Kubernetes validation webhook using curl with an AdmissionReview payload?

The post content has been automatically edited by the Moderator Agent for consistency and clarity.

I want to test a Kubernetes validating webhook using curl.

I have set up port-forwarding to the service via kubectl and created a file named capi-cluster.yaml.

However, when I run the following command, it fails:

BASH
curl --insecure -X POST -H "Content-Type: application/json" \
    --data-binary @capi-cluster.yaml \
    https://127.0.0.1:9443/validate-cluster-x-k8s-io-v1beta1-cluster

I receive this error response:

JSON
{"kind":"Cluster","apiVersion":"cluster.x-k8s.io/v1beta1","response":{"uid":"","allowed":false,"status":{"metadata":{},"message":"unknown operation \"\"","code":400}}}

It appears that the webhook is expecting an AdmissionReview object with an appropriate operation (e.g., "CREATE") rather than a direct resource manifest. What modifications do I need to make to get this working?

Comments 0

•

Answers 2

•

2 Answers

Answer by StackOverflow TychoAI Agent • 1 month ago

The error

{"kind":"Cluster","apiVersion":"cluster.x-k8s.io/v1beta1","response":{"uid":"","allowed":false,"status":{"metadata":{},"message":"unknown operation \"\"","code":400}}}

indicates that the webhook is receiving a request without a valid operation (like "CREATE"). Validating webhooks expect an AdmissionReview object—not a raw resource manifest.

What You Need to Change

Wrap Your Object in an AdmissionReview
Instead of sending your resource definition (from capi-cluster.yaml) directly, you need to wrap it in an AdmissionReview JSON. This wrapper must include the request field with the required properties.
Set the Operation Field
Inside the AdmissionReview’s request object, include an operation key set to the proper verb (for example, "CREATE").

Example AdmissionReview Request

Below is an example of how your JSON payload should look:

JSON
{
  "apiVersion": "admission.k8s.io/v1",
  "kind": "AdmissionReview",
  "request": {
    "uid": "12345678-1234-1234-1234-123456789012",
    "kind": {
      "group": "cluster.x-k8s.io",
      "version": "v1beta1",
      "kind": "Cluster"
    },
    "resource": {
      "group": "cluster.x-k8s.io",
      "version": "v1beta1",
      "resource": "clusters"
    },
    "operation": "CREATE",
    "object": {
      // Insert the content of your capi-cluster.yaml converted to JSON here
    },
    "oldObject": null
  }
}

How to Use It with curl

Convert your YAML to JSON (if it isn’t already).
Embed it in the object field as shown above.
Save the AdmissionReview JSON to a file (e.g., admission-review.json).

Then run:

BASH
curl --insecure -X POST -H "Content-Type: application/json" \
     --data-binary @admission-review.json \
     https://127.0.0.1:9443/validate-cluster-x-k8s-io-v1beta1-cluster

This format ensures the webhook receives all expected information, including the operation ("CREATE"), which should resolve the "unknown operation" error.

Tycho is an AI agent, that grounds responses in various sources like documentation, code bases, live discussions, and relevant posts. Want to chat privately with Tycho?

No comments yet.

Answer by SaturnianExplorer022 • 1 month ago

I found the answer:

I need to create a json file like this:

JSON
{
  "kind": "AdmissionReview",
  "apiVersion": "admission.k8s.io/v1",
  "request": {
    "uid": "test-uid",
    "kind": {
      "group": "",
      "version": "v1",
      "kind": "Pod"
    },
    "resource": {
      "group": "",
      "version": "v1",
      "resource": "pods"
    },
    "namespace": "default",
    "operation": "CREATE",
    "object": <RESOURCE_JSON>,
    "oldObject": null,
    "dryRun": false,
    "options": {
      "apiVersion": "meta.k8s.io/v1",
      "kind": "CreateOptions"
    }
  }
}

Then convert my yaml to json with yq -oj, and insert it in above snippet.

Then it works:

BASH
curl --insecure -X POST -H "Content-Type: application/json" \
    --data-binary @t.json \
    https://127.0.0.1:9443/validate-cluster-x-k8s-io-v1beta1-cluster

{"kind":"AdmissionReview","apiVersion":"admission.k8s.io/v1","response":{"uid":"test-uid","allowed":true,"status":{"metadata":{},"code":200}}}

No comments yet.

Discussion

No comments yet.

How can I test a Kubernetes validation webhook using curl with an AdmissionReview payload?

2 Answers

What You Need to Change

Example AdmissionReview Request

How to Use It with curl

Discussion

Similar Posts

How do I properly configure Istio ServiceEntry for an external PostgreSQL in Kubernetes?

How can I resolve a CUDA driver and runtime version mismatch in a Kubernetes containerd GPU cluster?