failed to call webhook

[diegoavitorino]

Hi, by trying to deploy any composition yaml, I'm facing the error bellow:

error occurred: failed calling webhook "compositions.apiextensions.crossplane.io": failed to call webhook: Post "https://crossplane-webhooks.crossplane-system.svc:9443/validate-apiextensions-crossplane-io-v1-composition?timeout=10s": context deadline exceeded

I Installed crossplane from the default way:

# helm install crossplane --namespace crossplane-system --create-namespace crossplane-stable/crossplane 

Just to make sure endpoint is responding:

# curl https://crossplane-webhooks.crossplane-system:9443/validate-apiextensions-crossplane-io-v1-composition?
curl: (60) SSL certificate problem: self-signed certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

# curl https://crossplane-webhooks.crossplane-system:9443/validate-apiextensions-crossplane-io-v1-composition? --insecure
{"response":{"uid":"","allowed":false,"status":{"metadata":{},"message":"contentType=, expected application/json","code":400}}}

I saw the links below but I don't know what I need to do to fix it?

#4732
#4748

thanks

[phisco]

Is it a managed Kubernetes cluster? EKS?

Is crossplane's pod running?

[diegoavitorino]

Is it a managed Kubernetes cluster? EKS?

Is crossplane's pod running?

exactly, it is an EKS cluster

I'm to be able to deploy resources individually, just to deploy composition I'm facing the error.

[phisco]

EKS has some issues with webhooks, Have a look here: https://medium.com/@denisstortisilva/kubernetes-eks-calico-and-custom-admission-webhooks-a2956b49bd0d

[diegoavitorino]

We are using VPC CNI instead Calico

I configured “hostNetwork: true” but still the same error

[negz]

Is this the same issue as #5520?

[diegoavitorino]

Just to share with all of you guys, the solution was to set 9443 port to ingress rule of Security group each node to source SG of EKS