How to fix failed calling webhook in Kubernetes

KubernetesINTERMEDIATEHIGHUpdated Dec 6, 2025· 171 views

Admission webhooks timeout because the webhook handler is slow, unavailable, or the cluster cannot reach it. Webhooks block pod creation/updates, causing deployments to fail. Fix by optimizing webhook performance, adding replicas behind a service, or adjusting timeout values.

Quick fix

Fixes failed calling webhook

kubectl get pods -n <webhook-namespace> -o wide
kubectl describe pod <webhook-pod> -n <webhook-namespace>
kubectl logs <webhook-pod> -n <webhook-namespace>
  1. Check webhook pod status
  2. Verify webhook service and endpoints
  3. Test webhook connectivity
  4. Review webhook configuration
kubernetes — error
kubectl get pods -n <webhook-namespace> -o wide
kubectl describe pod <webhook-pod> -n <webhook-namespace>
kubectl logs <webhook-pod> -n <webhook-namespace>
failed calling webhook

What this error means

Admission webhooks intercept API server requests (pod creation, updates, deletions) and must respond within timeoutSeconds (default 10s). If webhook times out, the API request fails per failurePolicy (Fail=reject, Ignore=allow). Timeouts indicate slow handler, network issues, or webhook unavailability.

Typical symptoms

  • Pod creation/updates timeout or hang
  • Error: "failed calling webhook {name}: the server is currently unable to handle the request"
  • Deployments stuck rolling out
  • kubectl apply commands hang indefinitely
  • Webhook events show timeout errors
  • Intermittent: webhook works sometimes, fails other times
  • Failures correlate with cluster load spikes

Common causes

  1. Webhook pod not running or not ready (CrashLoopBackOff)
  2. Webhook handler slow (expensive computation, external API calls)
  3. Network latency between API server and webhook
  4. Single webhook replica overloaded (no load balancing)
  5. Webhook DNS not resolving (.svc.cluster.local domain)
  6. TLS certificate issues preventing webhook connection
  7. Resource starvation (webhook pod under CPU/memory pressure)

How to fix "failed calling webhook"

1Check webhook pod status

Verify webhook is running:

bash
kubectl get pods -n <webhook-namespace> -o wide
kubectl describe pod <webhook-pod> -n <webhook-namespace>
kubectl logs <webhook-pod> -n <webhook-namespace>

Pod should be Running and Ready. Check logs for errors.

2Verify webhook service and endpoints

Check service configuration:

bash
kubectl get svc -n <webhook-namespace>
kubectl get endpoints <webhook-service> -n <webhook-namespace>
kubectl describe svc <webhook-service> -n <webhook-namespace>

Service should have endpoints pointing to ready pods.

3Test webhook connectivity

Test TLS connection to webhook:

bash
kubectl port-forward -n <namespace> svc/<webhook-service> 8443:8443

# In another terminal
curl -k https://localhost:8443/validate

If connection fails or times out, webhook is unreachable.

4Review webhook configuration

Check timeout and failure policy:

bash
kubectl get validatingwebhookconfigurations
kubectl get mutatingwebhookconfigurations
kubectl describe validatingwebhookconfig <name> | grep -A10 timeoutSeconds

Default timeout is 10s (1-30s range). Failur policy: Fail=reject, Ignore=allow on timeout.

5Increase webhook replicas

Add load balancing:

bash
kubectl scale deployment -n <namespace> <webhook> --replicas=3

Ensure multiple replicas are running and ready. Webhook service will load-balance across them.

6Optimize webhook handler

Reduce latency in webhook code:
- Remove external API calls or cache responses
- Optimize policy evaluation logic
- Profile webhook for bottlenecks
- Add connection pooling
- Reduce webhook scope via objectSelector/namespaceSelector

Example: validate only specific namespaces or resource types.

7Adjust timeout as last resort

Increase timeoutSeconds (use cautiously):

bash
kubectl patch validatingwebhookconfig <name> --type merge \
  -p '{"webhooks":[{"name":"<webhook>","timeoutSeconds":15}]}'

Max 30s. Higher timeouts may mask performance issues.

Advanced notes

Webhook timeouts block critical cluster operations; failures cascade. Use failurePolicy: Ignore only for non-critical webhooks (masks issues). Monitor webhook latency and set alerts if timeout rate >1%. Exclude webhook system namespaces from webhook rules to prevent recursion. Use sideEffects: None to ensure dry-run safety.

Frequently asked questions

What does "failed calling webhook" mean?
Admission webhooks intercept API server requests (pod creation, updates, deletions) and must respond within timeoutSeconds (default 10s). If webhook times out, the API request fails per failurePolicy (Fail=reject, Ignore=allow). Timeouts indicate slow handler, network issues, or webhook unavailability.
How do I fix "failed calling webhook"?
Admission webhooks timeout because the webhook handler is slow, unavailable, or the cluster cannot reach it. Webhooks block pod creation/updates, causing deployments to fail. Fix by optimizing webhook performance, adding replicas behind a service, or adjusting timeout values.
What causes "failed calling webhook"?
Webhook pod not running or not ready (CrashLoopBackOff) Webhook handler slow (expensive computation, external API calls) Network latency between API server and webhook
Is the "failed calling webhook" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading