article Internal error occurred: failed calling webhook (...) x509: certificate signed by unknown authority in Troubleshooting

Internal error occurred: failed calling webhook (...) x509: certificate signed by unknown authority

darynakovyrina — Fri, 01 Dec 2023 13:10:00 GMT

If you get this error after applying the DynaKube custom resource, your Kubernetes API server may be configured with a proxy. You need to exclude https://dynatrace-webhook.dynatrace.svc from that proxy.

Re: Internal error occurred: failed calling webhook (...) x509: certificate signed by unknown authority

Omkar164 — Tue, 09 Jan 2024 13:13:30 GMT

Hello,

I am getting below error while applying dynakube.yaml file.

Error from server (InternalError): error when creating "dynakube.yaml": Internal error occurred: failed calling webhook "webhook.dynatrace.com": failed to call webhook: Post "https://dynatrace-webhook.dynatrace.svc:443/validate?timeout=10s": context deadline exceeded

I have reviewed firewall egress 8443 port and for ingress 443 & 8443 port on your GKE cluster on both web & app cluster rule is applied kindly help me to know any other alternative to resolve this error.

Re: Internal error occurred: failed calling webhook (...) x509: certificate signed by unknown authority

Ashok_Selvaraj — Sun, 18 Feb 2024 09:37:52 GMT

Hello Experts, @darynakovyrina @Omkar164

I am facing the same issue, Is any workaround/solution available?

Re: Internal error occurred: failed calling webhook (...) x509: certificate signed by unknown authority

Andriy_Sidorkin — Wed, 21 Feb 2024 10:56:09 GMT

Hi, everyone!
re: "undefined" error for x509 certificate check from the comment above by Ashok

The issue was the old webhook deployment that is actually deployed outside of the dynatrace namespace,

resulting in some "leftovers" from the previous Operator version installations

and this was also preventing the new Operator version (0.15.0) from being installed from the Operator Hub.

To resolve the issue, we deleted all the deployed resources using

kubectl/oc delete -f openshift.yaml

Afterwards, the installation was completed successfully.

I hope this helps anyone stumbling into similar issues with the webhook.

Sincerest, Andrew

Re: Internal error occurred: failed calling webhook (...) x509: certificate signed by unknown authority

nrparra83 — Thu, 02 May 2024 14:19:37 GMT

Hi team,
I am presenting this same error, but I am implementing it for the first time in a kebernetes on premise environment with version v1.30.0, I have already validated permissions at the firewall level on ports 443 and 8443.

Has anyone been able to solve it?

Greetings,

Re: Internal error occurred: failed calling webhook (...) x509: certificate signed by unknown authority

gopher — Fri, 03 May 2024 06:28:00 GMT

Hi,

In your CRD
Under annotations, you can add:

feature.dynatrace.com/no-proxy: "dynakube-activegate.dynatrace.svc.cluster.local,.svc.cluster.local,.dynatrace.svc"

feature.dynatrace.com/oneagent-ignore-proxy: "true"

Also, if your pulling images from a private repository, this also should be included in the no-proxy.
There was a change after operator 14.2 that changed the way connections were handled.

This should help.

Thanks

Re: Internal error occurred: failed calling webhook (...) x509: certificate signed by unknown authority

satit_dpm — Wed, 13 Aug 2025 11:11:47 GMT

Hi all,

I know this thread is old, but I have encountered this issue with EKS and still unable to resolve it.
- EKS with K8s 1.30
- Try Dynatrace Operator 0.10.2 and 1.6.1 both

- Dynatrace Managed

To resolve, I have tried.
- Add rule to security group to allow ingress access to cluster nodes on port 8443 from anywhere [NOT WORKING]
- Add feature flags [NOT WORKING]

feature.dynatrace.com/no-proxy: ".dynatrace.svc,dynakube-activegate.dynatrace.svc.cluster.local,.svc.cluster.local"

feature.dynatrace.com/oneagent-ignore-proxy: "true"

- Suspect something wrong with the namespace, tried delete the whole dynatrace namespace and recreate [NOT WORKING]

Anyone has any idea please?

Regards,

Satit