ingress-nginx: MountVolume.SetUp failed for volume "webhook-cert" : secret "ingress-nginx-admission" not found

NGINX Ingress controller version:0.34.1

Kubernetes version (use kubectl version):1.18.1

Environment:

Cloud provider or hardware configuration:baremetal OS (e.g. from /etc/os-release):ubuntu16.04 Kernel (e.g. uname -a):4.4.0-184-generic.x86_64 Install tools:deploy.yaml

What happened: ingress-nginx-admission-create and ingress-nginx-admission-patch started intially but Ingress-nginx controller failed to start

NAMESPACE        NAME                                        READY   STATUS              RESTARTS   AGE
ingress-nginx    ingress-nginx-admission-create-6sph6        1/1     Running             2          86s
ingress-nginx    ingress-nginx-admission-patch-ks2cm         1/1     Running             2          86s
ingress-nginx    ingress-nginx-controller-7fd7d8df56-wpdnp   0/1     ContainerCreating   0          96s

What you expected to happen: Ingress-nginx controller should start successfully

How to reproduce it:

Install kubernetes cluster using kubeadm

Install the ingress controller

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/baremetal/deploy.yaml

Anything else we need to know:

vagrant@k8s-head:~$ kubectl describe pod ingress-nginx-controller-7fd7d8df56-wpdnp -n ingress-nginx
Name:           ingress-nginx-controller-7fd7d8df56-wpdnp
Namespace:      ingress-nginx
Priority:       0
Node:           k8s-node-1/192.168.205.11
Start Time:     Fri, 24 Jul 2020 01:49:42 +0000
Labels:         app.kubernetes.io/component=controller
                app.kubernetes.io/instance=ingress-nginx
                app.kubernetes.io/name=ingress-nginx
                pod-template-hash=7fd7d8df56
Annotations:    <none>
Status:         Pending
IP:             
IPs:            <none>
Controlled By:  ReplicaSet/ingress-nginx-controller-7fd7d8df56
Containers:
  controller:
    Container ID:  
    Image:         us.gcr.io/k8s-artifacts-prod/ingress-nginx/controller:v0.34.1@sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
    Image ID:      
    Ports:         80/TCP, 443/TCP, 8443/TCP
    Host Ports:    0/TCP, 0/TCP, 0/TCP
    Args:
      /nginx-ingress-controller
      --election-id=ingress-controller-leader
      --ingress-class=nginx
      --configmap=ingress-nginx/ingress-nginx-controller
      --validating-webhook=:8443
      --validating-webhook-certificate=/usr/local/certificates/cert
      --validating-webhook-key=/usr/local/certificates/key
    State:          Waiting
      Reason:       ContainerCreating
    Ready:          False
    Restart Count:  0
    Requests:
      cpu:      100m
      memory:   90Mi
    Liveness:   http-get http://:10254/healthz delay=10s timeout=1s period=10s #success=1 #failure=5
    Readiness:  http-get http://:10254/healthz delay=10s timeout=1s period=10s #success=1 #failure=3
    Environment:
      POD_NAME:       ingress-nginx-controller-7fd7d8df56-wpdnp (v1:metadata.name)
      POD_NAMESPACE:  ingress-nginx (v1:metadata.namespace)
    Mounts:
      /usr/local/certificates/ from webhook-cert (ro)
      /var/run/secrets/kubernetes.io/serviceaccount from ingress-nginx-token-4t6nq (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             False 
  ContainersReady   False 
  PodScheduled      True 
Volumes:
  webhook-cert:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  ingress-nginx-admission
    Optional:    false
  ingress-nginx-token-4t6nq:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  ingress-nginx-token-4t6nq
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason       Age               From                 Message
  ----     ------       ----              ----                 -------
  Normal   Scheduled    2m1s              default-scheduler    Successfully assigned ingress-nginx/ingress-nginx-controller-7fd7d8df56-wpdnp to k8s-node-1
  Warning  FailedMount  57s (x8 over 2m)  kubelet, k8s-node-1  MountVolume.SetUp failed for volume "webhook-cert" : secret "ingress-nginx-admission" not found

About this issue

  • Original URL
  • State: closed
  • Created 4 years ago
  • Reactions: 19
  • Comments: 57 (10 by maintainers)

Most upvoted comments

I managed to fix this by modifying --ingress-class=nginx to - --ingress-class=nginx2 in apply.yaml file so it was because there was an ingress class with the same name “nginx”

Still stucked. K8s 1.21 … MountVolume.SetUp failed for volume “webhook-cert” : secret “ingress-nginx-admission” not found

Finally, this worked for me. Run kubectl edit configmap kube-proxy -n kube-system and set maxPerCore under conntrack to 0 from null.

I am also get same issue, you can refer to my solution.

  1. Add “hostNetwork: true”, that can get pod ip.
  2. Change deploy “ingress-nginx-controller” secretName. image image image

Just ran into this too on EKS 1.17 (latest AMI) with helm chart v3.20.0

I am getting same issue with ingress-nginx-admission secret, tried editing create and patch job with ingress-ingress-nginx-admission-token-xxxxx still same error. Anyone have solution for this, i am using Chart version 3.11.1 ingress-nginx. Neither --kubeconfig nor --master was specified. Using the inClusterConfig. This might not work. {“err”:“secrets "ingress-nginx-admission-token-xxxxx" is forbidden: User "system:serviceaccount:ingress-nginx:ingress-nginx-admission" cannot get resource "secrets" in API group "" in the namespace "ingress-nginx"”,“level”:“fatal”,“msg”:“error getting secret”,“source”:“k8s/k8s.go:109”,“time”:“2021-11-23T22:05:01Z”}

When deploying with helm job are not deploying but ingress-controller is up and running, if you are using template of this chart then everything gets crashed

ingress-nginx ingress-nginx-admission-create-6sph6 1/1 Running 2 86s ingress-nginx ingress-nginx-admission-patch-ks2cm 1/1 Running 2 86s

The secret is created after these two jobs finish. After that, the pod will start. Keep in mind this only happens the first time you start the ingress controller

I change the yaml file . secretName: ingress-nginx-admission secretName: ingress-nginx-admission-token-l2nx8 image

IT can work!! image

This fix solve the issue for me: < --ingress-class=nginx> renamed to < --ingress-class=nginx2 > by editing the deployment as told by @AliBeddah

still happend in v0.45.0,somebody help

I encountered the same problem in version 1.18. My solution was to restart the Docker of the machine where Webhook is located, and the problem was solved. I felt that there was a problem with docker’s network bridge

in my case, if i install the ingress controller in control-plane, everthing looks good but i have no idea why

Anyone got this working? I am stuck in this same issue and not able to resolve …read almost all the related issues/solutions

怎么搞,没找到问题点啊,没找到答案啊

add, at the second date . I find a ture answaer, i belive.
delete all the svc. pods deployment , secret ,rs, cs, use yaml file when you apply except kube-system namespace like the under. kubectl delete -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.0.4/deploy/static/provider/cloud/deploy.yaml and apply the new kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.0.4/deploy/static/provider/cloud/deploy.yaml and everthing looks like good . image image

@aliencrash @FreddieMcHeart @yexk please use v0.41.0

same problem after: “kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.35.0/deploy/static/provider/cloud/deploy.yaml” tried doing the reset to kubernetes cluster, but didnt resolve. edit: doing a reset to factory default in docker, resolved it.

Reset docker ??? Has other methods?

Same