Kubernetes Ingress Annotation Errors - Fix Misconfigured Routing in CI
Ingress behavior beyond basic routing is driven by controller-specific annotations. A wrong prefix, an invalid value, or a path-type/rewrite mismatch makes the controller reject the Ingress or silently ignore the annotation - so routing misbehaves.
What this error means
An Ingress applies but routing is wrong (404s, no rewrite, no TLS redirect), or the controller logs an annotation validation error. kubectl describe ingress may show a rejected admission, or the annotation simply has no effect.
# controller admission webhook rejects a bad value:
Error from server: admission webhook "validate.nginx.ingress.kubernetes.io"
denied the request: annotation nginx.ingress.kubernetes.io/rewrite-target
contains invalid valueCommon causes
Wrong annotation prefix or key
Annotations are controller-specific (nginx.ingress.kubernetes.io/..., alb.ingress.kubernetes.io/...). A typo or the wrong controller’s prefix is ignored - the feature never activates.
Invalid value or path-type mismatch
A bad regex in rewrite-target, a value of the wrong type, or a pathType: Exact paired with a regex path makes the controller reject or mis-handle the rule.
How to fix it
Check the annotations and controller logs
kubectl get ingress <name> -o jsonpath='{.metadata.annotations}'; echo
kubectl -n <ingress-ns> logs -l app.kubernetes.io/name=ingress-nginx --tail=50 | grep -i <name>Use the correct annotation and matching pathType
- Match the annotation prefix to your installed controller.
- For regex rewrites, set
pathType: ImplementationSpecific(or the controller’s documented requirement) and a valid capture pattern. - Re-apply and confirm the controller accepts it and routing behaves as intended.
How to prevent it
- Use only the annotation set your specific ingress controller documents.
- Pair rewrite/regex paths with the pathType the controller requires.
- Smoke-test routes (rewrite, TLS redirect) after Ingress changes, not just apply success.