Edit the webhook configuration

Run the following command to open the Ocean admission controller webhook configuration:

kubectl edit MutatingWebhookConfiguration spot-admission-controller.kube-system.svc

Verify the object selector configuration

Make sure the following objectSelector block exists in the webhook configuration:

objectSelector:
  matchExpressions:
  - key: app.kubernetes.io/name
    operator: NotIn
    values:
    - spot-admission-controller

 This configuration prevents the webhook from mutating its own admission controller pods.

Reinstall the admission controller if needed

If the objectSelector block is missing, reinstall the Spot admission controller so the configuration is recreated correctly.

Update the failure policy

Locate the failurePolicy field and set it to Fail:

failurePolicy: Fail

This setting forces Kubernetes to wait for the admission controller to be available before allowing pod creation.

Save the changes

Save and close the editor to apply the updated webhook configuration.