--- title: "Rejecting Invalid Ingress Routes at Apply Time" url: https://daily.dev/posts/rejecting-invalid-ingress-routes-at-apply-time-jljoax92g source_url: https://engineering.zalando.com/posts/2026/04/skipper-validating-admission-webhook.html type: article source: "Zalando" published: 2026-04-09T17:45:27.243Z updated: 2026-04-09T17:45:52.900Z tags: ["kubernetes", "platform-engineering"] reading_time: 6 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rejecting Invalid Ingress Routes at Apply Time **[Zalando](https://daily.dev/sources/zalando)** · 6 min read · 1 upvotes · 0 comments ## Summary Zalando runs Skipper as a Kubernetes ingress controller across 250+ clusters handling up to 2M RPS. Because Kubernetes cannot validate Skipper-specific filters and predicates, invalid route configurations were silently accepted and only discovered at runtime. The solution was to run Skipper itself as a Kubernetes validating admission webhook, so that on every kubectl apply, the webhook uses Skipper's own filter registry and predicate specs to answer 'would Skipper accept this route?' rather than just checking syntax. Invalid routes are now rejected immediately with actionable error messages. The rollout was treated as a control-plane change: metrics were added first, the feature was gated behind a flag, and it was deployed tier by tier across clusters. The implementation is open-source in Skipper v0.24.18. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [How Zalando Built an In-Process Client-Side Load Balancer for One Million Requests per Second](https://daily.dev/posts/how-zalando-built-an-in-process-client-side-load-balancer-for-one-million-requests-per-second-gwprc272c) · InfoQ · 0 upvotes · 0 comments - [Client-Side Load Balancing at a Million Requests Per Second](https://daily.dev/posts/client-side-load-balancing-at-a-million-requests-per-second-bvi2j48ww) · Zalando · 20 upvotes · 1 comments - [Validating, scoring, and gating Kubernetes configuration after every change](https://daily.dev/posts/validating-scoring-and-gating-kubernetes-configuration-after-every-change-1umvnppcm) · ITNEXT · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#platform-engineering](https://daily.dev/tags/platform-engineering) [View this post on daily.dev](https://daily.dev/posts/rejecting-invalid-ingress-routes-at-apply-time-jljoax92g)