← Problem Library
K8s L6 K8S 1304 · 16 min

A validating webhook only times out on node-local DNS nodes because the stub domain config there never learned the internal zone the webhook target now uses

Most nodes admit pods normally, yet one subset fails because their local DNS chain cannot resolve the webhook backend's newer internal name.

K8sPlatform ReliabilityLevel 6Pro16 min
Scenario

Admission failures appear random after a service rename because only certain nodes run through a different DNS path.

What to check first
  • Identify the primary failure signal in the Webhook Path Depends on a DNS Layer Only Some Nodes Use scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Compare node-local DNS config and upstream zone knowledge before rotating webhook certs.

Questions worth viewing together
What should you verify first when A validating webhook only times out on node-local DNS nodes appears?

Community-field Kubernetes problem inspired by Discuss Kubernetes patterns where node-local DNS caused selective webhook timeouts. Webhook outages can be name-resolution path splits, not always network path splits.

What usually causes A validating webhook only times out on node-local DNS nodes in production?

Teams often rebuild webhook deployments when the failure exists entirely in node-local DNS configuration.

What should you document after resolving A validating webhook only times out on node-local DNS nodes?

Per-node DNS optimizations create extra resolution contracts that cluster-wide testing can miss.