How to Debug Kubernetes Validating Webhooks

func validate(w http.ResponseWriter, r *http.Request) {
    // Always denies everything:
    resp := admissionv1.AdmissionReview{
        Response: &admissionv1.AdmissionResponse{
            Allowed: false,
            Result: &metav1.Status{
                Message: "Rejected",
            },
        },
    }
    // (all creates/updates are blocked)
}

func validate(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    var review admissionv1.AdmissionReview
    json.Unmarshal(body, &review)

    allowed := true
    var message string
    // implement validation logic here
    // if validation fails:
    //   allowed = false
    //   message = "Validation failed: reason"

    resp := admissionv1.AdmissionReview{
        TypeMeta: review.TypeMeta,
        Response: &admissionv1.AdmissionResponse{
            Allowed: allowed,
            UID:     review.Request.UID,
            Result: &metav1.Status{
                Message: message,
            },
        },
    }
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(resp)
}

// The request is v1beta1.AdmissionReview, handler returns v1.AdmissionReview

func validate(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    var review admissionv1.AdmissionReview
    json.Unmarshal(body, &review)
    // Use the same apiVersion in the response:
    resp := admissionv1.AdmissionReview{
        TypeMeta: metav1.TypeMeta{
            APIVersion: review.APIVersion,  // match the request version
            Kind:       "AdmissionReview",
        },
        Response: &admissionv1.AdmissionResponse{
            UID:     review.Request.UID,
            Allowed: true,
        },
    }
}

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
webhooks:
- name: webhook.example.com
  matchConditions:
  - name: skip-default-namespace
    expression: "request.namespace != 'default'"
  # The webhook does not fire for resources in the 'default' namespace

objectSelector:
  matchLabels:
    validate: "true"
# Only resources with label validate=true trigger the webhook

# Remove objectSelector entirely for all-resources validation

# For testing without blocking resources:
sideEffects: None
timeoutSeconds: 5

# Replace the webhook config's failurePolicy:
failurePolicy: Ignore

# Two validating webhooks — one rejects, the other allows
# The rejected resource is denied regardless of the second webhook

reinvocationPolicy: IfNeeded  # for mutating webhooks