Azure / Azure/azure-workload-identity

Webhook timeout error during pod mutation

Open
#1,608 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
337
Forks
122
Avg merge
1h 7m
Merged PRs (30d)
3

Description

We’re experiencing intermittent issues with the Azure Workload Identity webhook in version **1.5.0**. Our setup runs 4 pods of the webhook service.

This occurs during pod creation, particularly from **Argo Workflows,** with the following error
```bash
Internal error occurred: failed calling webhook "mutation.azure-workload-identity.io": failed to call webhook: Post "https://azure-wi-webhook-webhook-service.azure-workload-identity-system.svc:443/mutate-v1-pod?timeout=10s": context deadline exceeded
```

From the webhook logs, we only see occasional messages like:
```bash
{"level":"info","timestamp":"2025-05-19T08:19:49.001573Z","caller":"/usr/local/go/src/log/log.go:245$log.(*Logger).output","message":"http: TLS handshake error from 10.61.91.69:52362: EOF"}
```

The issue is **random**, not constant, but it blocks workflow execution. Any guidance on diagnosing or mitigating this would be appreciated.

Contributor guide

No contributing guide indexed for this repository

Research direction

No repository file, test, or entry point is named. Start by reproducing pod creation through Argo Workflows with four webhook replicas and inspect the webhook logs alongside the TLS handshake and timeout errors; done means identifying the intermittent failure and documenting a verified mitigation.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go, kubernetes
Domain
authentication, cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.