{"record":{"id":"460ad496b6df208c","repo":"kubernetes/kubernetes","slug":"retry-backoff-parameters-for-authorization-webhook","errorCode":null,"errorMessage":"retry backoff parameters for authorization webhook has not been specified","messagePattern":"retry backoff parameters for authorization webhook has not been specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/kubeapiserver/authorizer/reload.go","lineNumber":154,"sourceCode":"\t\tcase authzconfig.AuthorizerType(modes.ModeAlwaysDeny):\n\t\t\talwaysDenyAuthorizer := authorizerfactory.NewAlwaysDenyAuthorizer()\n\t\t\tauthorizers = append(authorizers, union.NamedAuthorizer{\n\t\t\t\tAuthorizerName: configuredAuthorizer.Name,\n\t\t\t\tAuthorizer:     authorizationmetrics.InstrumentedAuthorizer(string(configuredAuthorizer.Type), configuredAuthorizer.Name, alwaysDenyAuthorizer),\n\t\t\t})\n\t\t\truleResolvers = append(ruleResolvers, alwaysDenyAuthorizer)\n\t\tcase authzconfig.AuthorizerType(modes.ModeABAC):\n\t\t\tif r.abacAuthorizer == nil {\n\t\t\t\treturn nil, nil, fmt.Errorf(\"authorizer type ABAC is not allowed if it was not enabled at initial server startup\")\n\t\t\t}\n\t\t\tauthorizers = append(authorizers, union.NamedAuthorizer{\n\t\t\t\tAuthorizerName: configuredAuthorizer.Name,\n\t\t\t\tAuthorizer:     authorizationmetrics.InstrumentedAuthorizer(string(configuredAuthorizer.Type), configuredAuthorizer.Name, r.abacAuthorizer),\n\t\t\t})\n\t\t\truleResolvers = append(ruleResolvers, r.abacAuthorizer)\n\t\tcase authzconfig.AuthorizerType(modes.ModeWebhook):\n\t\t\tif r.initialConfig.WebhookRetryBackoff == nil {\n\t\t\t\treturn nil, nil, errors.New(\"retry backoff parameters for authorization webhook has not been specified\")\n\t\t\t}\n\t\t\tclientConfig, err := webhookutil.LoadKubeconfig(*configuredAuthorizer.Webhook.ConnectionInfo.KubeConfigFile, r.initialConfig.CustomDial)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, nil, err\n\t\t\t}\n\t\t\tif configuredAuthorizer.Webhook.Timeout.Duration != 0 {\n\t\t\t\tclientConfig.Timeout = configuredAuthorizer.Webhook.Timeout.Duration\n\t\t\t}\n\t\t\tvar decisionOnError authorizer.Decision\n\t\t\tswitch configuredAuthorizer.Webhook.FailurePolicy {\n\t\t\tcase authzconfig.FailurePolicyNoOpinion:\n\t\t\t\tdecisionOnError = authorizer.DecisionNoOpinion\n\t\t\tcase authzconfig.FailurePolicyDeny:\n\t\t\t\tdecisionOnError = authorizer.DecisionDeny\n\t\t\tdefault:\n\t\t\t\treturn nil, nil, fmt.Errorf(\"unknown failurePolicy %q\", configuredAuthorizer.Webhook.FailurePolicy)\n\t\t\t}\n","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/pkg/kubeapiserver/authorizer/reload.go#L136-L172","documentation":"Thrown during authorization webhook reload (buildAuthorizers) when r.initialConfig.WebhookRetryBackoff is nil but a Webhook authorizer type is configured. The webhook authorizer needs backoff parameters for retries; their absence prevents constructing the webhook authorizer on (re)load.","triggerScenarios":"An authorization configuration (AuthorizationConfig) with an authorizer of type Webhook while initialConfig.WebhookRetryBackoff was never set. The reload logic cannot build the webhook authorizer.","commonSituations":"Using --authorization-webhook-config-file or a structured AuthorizationConfig with webhook authorizers but the reloader's initialConfig lacks the backoff; embedded apiserver wiring that skipped the backoff default; reload after a config change exposing the missing field.","solutions":["Provide a non-nil WebhookRetryBackoff in the authorizer reload initialConfig (mirroring the apiserver default backoff).","Ensure the kube-apiserver sets the default backoff whenever webhook authorization is enabled.","If running a custom authorization reload path, populate initialConfig.WebhookRetryBackoff before buildAuthorizers."],"exampleFix":"// before\n// initialConfig.WebhookRetryBackoff = nil\n// after\n// initialConfig.WebhookRetryBackoff = &wait.Backoff{Duration: 500*time.Millisecond, Factor: 1.5, Jitter: 0.2, Steps: 5}","handlingStrategy":"validation","validationCode":"// Ensure backoff is set before authorizer reload builds webhook authorizers\nif initialConfig.WebhookRetryBackoff == nil { initialConfig.WebhookRetryBackoff = defaultWebhookBackoff() }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Populate WebhookRetryBackoff in the authorizer reload initialConfig whenever webhook authorization is configured.","Share a single default-backoff helper between authn and authz webhook config builders."],"tags":["apiserver","authorization","webhook","kubernetes","configuration","startup"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}