Budget analytics finds valid object creates rejected after a recent kube-apiserver flag change around admission. What should be investigated first?
Select an answer to reveal the explanation.
Short Explanation
Admission is the API's bouncer. If someone flipped apiserver flags wrong, good objects get bounced at the door—check admission plugin configuration before blaming DNS or metrics.
Full Explanation
Admission plugins on kube-apiserver validate or mutate objects during create and update. After a recent kube-apiserver flag change around admission, budget analytics finding valid object creates rejected should investigate misconfigured admission plugins or related flags first—the API’s bouncer may now deny objects that previously passed. CoreDNS ConfigMap typos do not uniquely return admission denial for all CRDs; DNS problems present as resolution failures, not admission reject responses from the apiserver. A missing metrics-server Deployment does not always block object admission; resource metrics are orthogonal to most create admission paths. NodePort Service conflicts do not rewrite apiserver admission configuration nightly; that option invents an unrelated mechanism. Exam caveat: Read the exact denial—validating webhook timeouts can fail closed if the webhook service is unreachable. After flag changes, compare enable-admission-plugins and webhook configs to the last known-good civic baseline. Operational check: Review the kube-apiserver manifest admission flags and webhook configurations, correct the misconfiguration, retry a minimal create, and confirm the admission error clears for legitimate budget objects.