Crossplane admission webhook error on apply in CI

Crossplane registers validating admission webhooks for XRDs and Compositions. If the webhook service is not ready or unreachable, the API server cannot call it and rejects the apply until the webhook responds.

What this error means

A kubectl apply of a Composition or XRD fails with "Internal error occurred: failed calling webhook ... crossplane.io: ... connection refused" shortly after installing core.

Error from server (InternalError): error when creating "composition.yaml":
Internal error occurred: failed calling webhook "compositions.apiextensions.crossplane.io":
failed to call webhook: Post "https://crossplane-webhooks.crossplane-system.svc:9443/...":
dial tcp ...: connect: connection refused

Common causes

The webhook service is not ready yet

Applying immediately after installing core races the webhook pod, so the API server cannot reach it.

The webhook endpoint is unreachable

A crashed webhook pod, or network policy blocking the API server, leaves the webhook endpoint refusing connections.

How to fix it

Wait for the webhook to be ready

1. Wait for the crossplane deployment rollout to finish.
2. Confirm the webhook service has ready endpoints.
3. Then apply Compositions and XRDs.

kubectl -n crossplane-system rollout status deploy/crossplane
kubectl -n crossplane-system get endpoints crossplane-webhooks

Diagnose a crashing webhook pod

If endpoints stay empty, inspect the crossplane pod logs for the crash keeping the webhook down.

kubectl -n crossplane-system logs deploy/crossplane --tail=50

How to prevent it

• Wait for core rollout and webhook endpoints before applying resources.
• Do not apply Compositions in the same instant core is installed.
• Ensure network policy allows the API server to reach the webhook service.

Related guides