Kyma

Appearance

Unable to Create, Modify, or Delete an APIRule v1beta1 ​

Symptoms ​

  • Kyma dashboard does not display APIRules created in version v1beta1.

  • APIRules obtained via kubectl get are in the Error status.

    bash
    kubectl get apirules.gateway.kyma-project.io -A

NAMESPACE   NAME                STATUS    HOSTS
default     example-apirule     Error     ["example-host"]

  • When you try to create, modify, or delete an APIRule created in version v1beta1 using kubectl, you encounter an error related to the admission webhook.

    bash
    kubectl apply -f <apirule-v1beta1.yaml> -n $NAMESPACE $APIRULE_NAME -oyaml

Warning: Version v1beta1 of APIRule is no longer supported. Migrate to version v2.
Error from server (Forbidden): error when creating "STDIN": admission webhook "v1beta1-admission.apirule.gateway.kyma-project.io" denied the request: v1beta1 APIRule version is no longer supported, please use v2 instead
    bash
    kubectl edit apirules.v1beta1.gateway.kyma-project.io -n $NAMESPACE $APIRULE_NAME -oyaml

Warning: Version v1beta1 of APIRule is no longer supported. Migrate to version v2.
error: apirules.gateway.kyma-project.io "hello-kymav1beta1" could not be patched: admission webhook "v1beta1-admission.apirule.gateway.kyma-project.io" denied the request: v1beta1 APIRule version is no longer supported, please use v2 instead
You can run `kubectl replace -f <temporary-file-path>` to try this update again.
    bash
    kubectl delete apirules.v1beta1.gateway.kyma-project.io -n $NAMESPACE $APIRULE_NAME -oyaml

Warning: Version v1beta1 of APIRule is no longer supported. Migrate to version v2.
Error from server (Forbidden): admission webhook "v1beta1-admission.apirule.gateway.kyma-project.io" denied the request: v1beta1 APIRule version is no longer supported, please use v2 instead

Cause ​

The APIRule custom resource v1beta1 is deleted. While all v1beta1 APIRules remain fully operational in the background, you can't create, modify, or delete APIRule CRs in version v1beta1. Additionally, you can't display APIRules v1beta1 in Kyma dashboard. Only v2 APIRules are supported, as v2 is now the latest stable APIRule version in the Kubernetes API.

All v1beta1 APIRule configurations created before this change in existing clusters remain active, so already exposed workloads stay exposed and secured. However, reconciliation of APIRule v1beta1 is disabled: the API Gateway module no longer reconciles these APIRules or manages their sub-resources. If a v1beta1 APIRule is no longer reconciled, it is in the Error status. For details, see APIRule v1beta1 Is No Longer Reconciled.

NOTE

For the complete deletion timeline for SAP BTP, Kyma runtime, see APIRule Migration Timeline.

Solution ​

To make sure that support for your APIRules is maintained, you must migrate them to version v2. To learn how to do this, follow the APIRule migration guide.