Why does the Membrane Kubernetes validation webhook return Error handling request?

The kubernetesValidation plugin, which acts as a Kubernetes validating admission webhook, could not process an admission request. Common causes are an invalid AdmissionReview or a resource kind without a bundled schema.

How do I fix Error handling request in the Membrane admission webhook?

Register the webhook only for Membrane's own custom resources and their API group, and check the gateway log for the full exception.

How do I hide the details in Membrane error responses?

Enable production mode by adding a configuration document with production: true to your apis.yaml. Membrane then leaves out detailed information from error responses.

500 Internal Server Error: Kubernetes Admission Webhook Error

Membrane API Gateway returns 500 Internal Server Error with the detail Error handling request! when the kubernetesValidation plugin cannot process an admission request. Membrane uses this plugin as a Kubernetes validating admission webhook, so the caller is the Kubernetes API server. The cause is a request the webhook cannot handle, or the webhook's configuration.

The Error Response

The response contains the status 500 Internal Server Error, the detail Error handling request!, the problem type https://membrane-api.io/problems/internal and a link to this page. The type internal means that the gateway failed while processing the exchange.

Common Causes

The Body Is Not an AdmissionReview

The request body is not a valid AdmissionReview JSON document.

The Request or Kind Is Missing

The AdmissionReview has no request field, or the object in it has no kind.

No Schema for the Resource Kind

Membrane only ships JSON schemas for its own custom resources. If the webhook is registered for another resource kind, there is no schema to validate against.

The Body Could Not Be Read

The connection was closed before the body was complete.

An Unexpected Exception in the kubernetesValidation Plugin

The same link is also used when the kubernetesValidation plugin throws an exception that it does not handle itself. The detail then starts with Aborting! Exception caused in ... and names the flow. Membrane logs such exceptions at warn level with the stack trace. If the plugin is nested in request, response or abort, the exception message and stack trace are sent to the client even in production mode. Unless the exception points to your configuration or to the message content, this usually indicates a bug in Membrane.

How to Fix It

Check the gateway log. Membrane logs the full exception at error level.
Register the webhook only for Membrane's own custom resources and only for the API group they belong to.
If the admission request was valid and for a supported kind, report the problem with the stack trace on GitHub Issues.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem, including the link to this page. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---.

In production mode, the title of this error is replaced by Internal Server Error, and the response only says Internal details are hidden. See server log (key: ...). Search the gateway log for that key to find the full error message.