{"record":{"id":"65576a7f15ff4912","repo":"kubernetes/kubernetes","slug":"validatingwebhookconfiguration-q-conversion-erro","errorCode":null,"errorMessage":"ValidatingWebhookConfiguration %q: conversion error: %w","messagePattern":"ValidatingWebhookConfiguration %q: conversion error: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/admission/plugin/webhook/manifest/loader/loader.go","lineNumber":135,"sourceCode":"\t}\n\tif l, ok := obj.(*admissionregistrationv1.MutatingWebhookConfigurationList); ok {\n\t\titems := make([]*admissionregistrationv1.MutatingWebhookConfiguration, len(l.Items))\n\t\tfor i := range l.Items {\n\t\t\titems[i] = &l.Items[i]\n\t\t}\n\t\treturn items, true\n\t}\n\treturn nil, false\n}\n\n// defaultAndValidateVWC applies scheme defaults and runs standard API validation\n// on a ValidatingWebhookConfiguration.\nfunc defaultAndValidateVWC(config *admissionregistrationv1.ValidatingWebhookConfiguration) error {\n\tscheme.Default(config)\n\n\tinternalObj := &admissionregistration.ValidatingWebhookConfiguration{}\n\tif err := scheme.Convert(config, internalObj, nil); err != nil {\n\t\treturn fmt.Errorf(\"ValidatingWebhookConfiguration %q: conversion error: %w\", config.Name, err)\n\t}\n\tif errs := validation.ValidateValidatingWebhookConfiguration(internalObj); len(errs) > 0 {\n\t\treturn fmt.Errorf(\"ValidatingWebhookConfiguration %q: %w\", config.Name, errs.ToAggregate())\n\t}\n\tresultConfig := &admissionregistrationv1.ValidatingWebhookConfiguration{}\n\tif err := scheme.Convert(internalObj, resultConfig, nil); err != nil {\n\t\treturn fmt.Errorf(\"ValidatingWebhookConfiguration %q: back-conversion error: %w\", config.Name, err)\n\t}\n\t*config = *resultConfig\n\treturn nil\n}\n\n// defaultAndValidateMWC applies scheme defaults and runs standard API validation\n// on a MutatingWebhookConfiguration.\nfunc defaultAndValidateMWC(config *admissionregistrationv1.MutatingWebhookConfiguration) error {\n\tscheme.Default(config)\n\n\tinternalObj := &admissionregistration.MutatingWebhookConfiguration{}","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/94c136764292cc5fac976c0de6587daaea56410f/pkg/admission/plugin/webhook/manifest/loader/loader.go#L117-L153","documentation":"Returned when a ValidatingWebhookConfiguration loaded from a static manifest fails to convert from the v1 external type to the internal type during defaultAndValidateVWC. The forward conversion at line 134 maps the decoded v1 webhook config to the internal representation for semantic validation. Failure means the manifest contains a field value the converter cannot map.","triggerScenarios":"A YAML file decoding as a ValidatingWebhookConfiguration triggers scheme.Convert(config, internalObj, nil) failure at line 134. This happens when the webhook config uses a field value (e.g., an unsupported sideEffectClass enum, an invalid matchPolicy, or an unknown admissionReviewVersions value) that the converter rejects when mapping to the internal type.","commonSituations":"Using fields or enum values from a newer Kubernetes version on an older apiserver. Hand-editing YAML with invalid values for matchPolicy, sideEffects, or timeoutSeconds. Custom scheme missing conversion functions.","solutions":["Check the wrapped error in the apiserver log for the offending field.","Align the manifest's field values with the running apiserver's supported set (check admissionregistration API reference).","Upgrade the apiserver or remove/fix unsupported fields in the YAML.","For dev builds, run 'make update' and verify scheme installation."],"exampleFix":"// before: invalid sideEffects value\nspec:\n  sideEffects: Some  # invalid — must be None, Some, SomeOnDryRun, or Unknown\n\n// after: valid value\nspec:\n  sideEffects: None","handlingStrategy":"try-catch","validationCode":"// Validate webhook config manifests with kubectl before deployment\n// kubectl apply --dry-run=server -f webhook-config.yaml","typeGuard":null,"tryCatchPattern":"result, err := loader.LoadValidatingManifests(dir)\nif err != nil {\n    if strings.Contains(err.Error(), \"conversion error\") {\n        klog.Errorf(\"webhook config conversion failed — check API version: %v\", err)\n    }\n    return err\n}","preventionTips":["Align webhook config fields with the running apiserver's supported versions.","Use only valid enum values for sideEffects, matchPolicy, and failurePolicy.","Validate with kubectl apply --dry-run=server."],"tags":["admission-control","webhook","scheme-conversion","manifest-loader","kubernetes"],"backgroundTag":null,"analyzedSha":"94c136764292cc5fac976c0de6587daaea56410f","analyzedAt":"2026-08-08T23:58:27.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}