Back to Schedule

Fail Fast Routing: Reusing the Ingress Controller as a Kubernetes Admission Webhook

Veronika Volokitina

17:00 - 17:45

Pavillon

A broken route should fail where it is introduced, not later when the ingress controller finally tries to load it. Kubernetes can validate object structure, but it cannot know whether a custom routing rule is actually valid for a specific controller. At Zalando we hit this with Skipper, our open-source HTTP router and Kubernetes ingress controller: manifests could pass CI/CD while a typo in a predicate, invalid filter parameters, or an unparsable backend only surfaced later in the routing layer. At our scale, 250+ clusters, 15k+ ingresses, ~200k routes and 500k-2M RPS, this became real production risk. This talk shows how we moved that feedback to `kubectl apply` by reusing Skipper’s own route-processing logic inside a validating admission webhook. Instead of building a separate validator that would drift from runtime behavior, the webhook uses the same filter registry, predicate specs and backend checks as Skipper itself. Attendees will leave with a reusable pattern for admission-time semantic validation, a checklist for making controller-backed validation safe on the Kubernetes control-plane path, and concrete ideas for observability during rollout. The examples use Skipper, but the lessons apply to any operator or controller whose real validation logic already lives in production code. Blog Post https://engineering.zalando.com/posts/2026/04/skipper-validating-admission-webhook.html