We have noticed an instance of Incorrect Admission Validator in your repository.

[zyue110026]

What version of Knative?

0.9.x
0.10.x
0.11.x
Output of git describe --dirty

We observed that the admission validation logic has a circular dependency on the resource it validates.

Specifically, the validating webhook relies on the existence of the target resource during initialization. If the resource is deleted before the webhook is recreated, the webhook fails to start because it cannot access the required resource. As a result, the webhook deployment cannot be completed successfully. The validating webhook cannot be redeployed under certain recovery scenarios, preventing admission validation from being restored and potentially blocking normal cluster operation.

Webhook : config.webhook.serving.knative.dev
Resource: configmaps

Expected Behavior

The validating webhook should not depend on the existence of the resource it validates during startup. It should initialize successfully even if no target resources currently exist, or handle the missing resource gracefully without preventing deployment.

Actual Behavior

The webhook fails to start because it attempts to access the resource it validates during initialization. As a result, the webhook deployment fails until the missing resource is restored or the dependency is otherwise resolved.

Steps to Reproduce the Problem

1. Deploy the application.
2. Delete the resource that the validating webhook validates.
3. Delete the validating webhook.
4. Redeploy the validating webhook.
5. Observe that the webhook deployment fails.
6. Inspect the webhook logs.

{"severity":"EMERGENCY","timestamp":"2026-07-08T19:51:46.693209252Z","logger":"webhook","caller":"sharedmain/main.go:311","message":"Failed to start configmap watcher","commit":"3bd82a6","knative.dev/pod":"webhook-99b85d99d-cgfn2","error":"configmap \"config-defaults\" not found","stacktrace":"knative.dev/pkg/injection/sharedmain.MainWithConfig\n\tknative.dev/pkg@v0.0.0-20260531000007-52dbd5ece63f/injection/sharedmain/main.go:311\nknative.dev/pkg/injection/sharedmain.MainWithContext\n\tknative.dev/pkg@v0.0.0-20260531000007-52dbd5ece63f/injection/sharedmain/main.go:226\nmain.main\n\tknative.dev/serving/cmd/webhook/main.go:171\nruntime.main\n\truntime/proc.go:290"}

serving version: 1.22.1