Fail Fast Routing: Reusing the Ingress Controller as a Kubernetes Admission Webhook

A broken route should fail where it is introduced, not later when the ingress controller finally tries to load it.

Kubernetes can validate object structure, but it cannot know whether a custom routing rule is actually valid for a specific controller. At Zalando we hit this with Skipper, our open-source HTTP router and Kubernetes ingress controller: manifests could pass CI/CD while a typo in a predicate, invalid filter parameters, or an unparsable backend only surfaced later in the routing layer. At our scale, 250+ clusters, 15k+ ingresses, ~200k routes and 500k-2M RPS, this became real production risk.

This talk shows how we moved that feedback to `kubectl apply` by reusing Skipper’s own route-processing logic inside a validating admission webhook. Instead of building a separate validator that would drift from runtime behavior, the webhook uses the same filter registry, predicate specs and backend checks as Skipper itself.

Blog Post https://engineering.zalando.com/posts/2026/04/skipper-validating-admission-webhook.html