kubernetes/kubernetes · error

ValidatingWebhookConfiguration %q: conversion error: %w

Error message

ValidatingWebhookConfiguration %q: conversion error: %w

What it means

Returned when a ValidatingWebhookConfiguration loaded from a static manifest fails to convert from the v1 external type to the internal type during defaultAndValidateVWC. The forward conversion at line 134 maps the decoded v1 webhook config to the internal representation for semantic validation. Failure means the manifest contains a field value the converter cannot map.

Source

Thrown at pkg/admission/plugin/webhook/manifest/loader/loader.go:135

	}
	if l, ok := obj.(*admissionregistrationv1.MutatingWebhookConfigurationList); ok {
		items := make([]*admissionregistrationv1.MutatingWebhookConfiguration, len(l.Items))
		for i := range l.Items {
			items[i] = &l.Items[i]
		}
		return items, true
	}
	return nil, false
}

// defaultAndValidateVWC applies scheme defaults and runs standard API validation
// on a ValidatingWebhookConfiguration.
func defaultAndValidateVWC(config *admissionregistrationv1.ValidatingWebhookConfiguration) error {
	scheme.Default(config)

	internalObj := &admissionregistration.ValidatingWebhookConfiguration{}
	if err := scheme.Convert(config, internalObj, nil); err != nil {
		return fmt.Errorf("ValidatingWebhookConfiguration %q: conversion error: %w", config.Name, err)
	}
	if errs := validation.ValidateValidatingWebhookConfiguration(internalObj); len(errs) > 0 {
		return fmt.Errorf("ValidatingWebhookConfiguration %q: %w", config.Name, errs.ToAggregate())
	}
	resultConfig := &admissionregistrationv1.ValidatingWebhookConfiguration{}
	if err := scheme.Convert(internalObj, resultConfig, nil); err != nil {
		return fmt.Errorf("ValidatingWebhookConfiguration %q: back-conversion error: %w", config.Name, err)
	}
	*config = *resultConfig
	return nil
}

// defaultAndValidateMWC applies scheme defaults and runs standard API validation
// on a MutatingWebhookConfiguration.
func defaultAndValidateMWC(config *admissionregistrationv1.MutatingWebhookConfiguration) error {
	scheme.Default(config)

	internalObj := &admissionregistration.MutatingWebhookConfiguration{}

View on GitHub (pinned to 94c1367642)

Solutions

1. Check the wrapped error in the apiserver log for the offending field.
2. Align the manifest's field values with the running apiserver's supported set (check admissionregistration API reference).
3. Upgrade the apiserver or remove/fix unsupported fields in the YAML.
4. For dev builds, run 'make update' and verify scheme installation.

Example fix

// before: invalid sideEffects value
spec:
  sideEffects: Some  # invalid — must be None, Some, SomeOnDryRun, or Unknown

// after: valid value
spec:
  sideEffects: None

// Validate webhook config manifests with kubectl before deployment
// kubectl apply --dry-run=server -f webhook-config.yaml

result, err := loader.LoadValidatingManifests(dir)
if err != nil {
    if strings.Contains(err.Error(), "conversion error") {
        klog.Errorf("webhook config conversion failed — check API version: %v", err)
    }
    return err
}

When it happens

Trigger: A YAML file decoding as a ValidatingWebhookConfiguration triggers scheme.Convert(config, internalObj, nil) failure at line 134. This happens when the webhook config uses a field value (e.g., an unsupported sideEffectClass enum, an invalid matchPolicy, or an unknown admissionReviewVersions value) that the converter rejects when mapping to the internal type.

Common situations: Using fields or enum values from a newer Kubernetes version on an older apiserver. Hand-editing YAML with invalid values for matchPolicy, sideEffects, or timeoutSeconds. Custom scheme missing conversion functions.

Related errors

• ValidatingWebhookConfiguration %q: back-conversion error: %w
• MutatingWebhookConfiguration %q: conversion error: %w
• MutatingWebhookConfiguration %q: back-conversion error: %w
• MutatingAdmissionPolicy %q: back-conversion error: %w
• MutatingAdmissionPolicyBinding %q: conversion error: %w

AI-assisted analysis of kubernetes/kubernetes@94c1367642 (2026-08-08). Data as JSON: /api/errors/65576a7f15ff4912. Report an issue: GitHub.