Helm Ingress API Version Manifest Validator

Threat/Impact Level: HIGH | Downtime Risk: HIGH | Time to Fix: 5–15 mins

TL;DR

• What broke: Your Helm chart hardcodes apiVersion: networking.k8s.io/v1beta1 for its Ingress resource. Kubernetes 1.22 permanently removed this API — the cluster's API server no longer recognizes it, so kubectl cannot instantiate the object and the release fails entirely.
• How to fix it: Update the Ingress manifest to apiVersion: networking.k8s.io/v1, add the required pathType field, and migrate the backend stanza to the new nested service.name / service.port.number structure.
• Fast path: Use our Client-Side Sandbox above to auto-refactor this — paste your templates/ingress.yaml and it rewrites the manifest locally without touching your cluster or leaking your hostnames.

Error: INSTALLATION FAILED: unable to build kubernetes objects from release manifest:
[unable to recognize "": no matches for kind "Ingress" in version "networking.k8s.io/v1beta1"]

How to Fix It

Basic Fix — Update the Ingress template directly

Locate templates/ingress.yaml inside your chart. The v1 spec has three breaking structural changes from v1beta1:

1. apiVersion changes.
2. Each path entry requires an explicit pathType field (Prefix, Exact, or ImplementationSpecific).
3. The backend field is restructured from a flat map to a nested service object.

- apiVersion: networking.k8s.io/v1beta1
+ apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: my-app-ingress
    annotations:
      nginx.ingress.kubernetes.io/rewrite-target: /
  spec:
    rules:
    - host: app.example.com
      http:
        paths:
-       - path: /
-         backend:
-           serviceName: my-app-svc
-           servicePort: 80
+       - path: /
+         pathType: Prefix
+         backend:
+           service:
+             name: my-app-svc
+             port:
+               number: 80

Enterprise Best Practice — Helm chart version gate + conditional template rendering

If you maintain a chart consumed by multiple teams across mixed cluster versions (unlikely post-2023 but still seen in air-gapped environments), use Helm's built-in Capabilities object to render the correct API version at template time:

- apiVersion: networking.k8s.io/v1beta1
+ {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
+ apiVersion: networking.k8s.io/v1
+ {{- else }}
+ apiVersion: networking.k8s.io/v1beta1
+ {{- end }}
  kind: Ingress
  metadata:
    name: {{ include "mychart.fullname" . }}
  spec:
    rules:
    - host: {{ .Values.ingress.host }}
      http:
        paths:
+       {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
        - path: {{ .Values.ingress.path | default "/" }}
+         pathType: {{ .Values.ingress.pathType | default "Prefix" }}
          backend:
+           service:
+             name: {{ include "mychart.fullname" . }}
+             port:
+               number: {{ .Values.service.port }}
+       {{- else }}
+       - path: {{ .Values.ingress.path | default "/" }}
+         backend:
+           serviceName: {{ include "mychart.fullname" . }}
+           servicePort: {{ .Values.service.port }}
+       {{- end }}

Also run helm template locally before pushing:

# Render manifests and pipe through kubectl dry-run against your actual cluster
helm template my-release ./mychart | kubectl apply --dry-run=server -f -

--dry-run=server (not client) hits the real API server GVK registry — it will catch deprecated API versions before helm install does.

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# Install
brew install FairwindsOps/tap/pluto

# Scan a rendered chart before deploy
helm template my-release ./mychart | pluto detect -

# Expected output for a bad chart:
# NAME               KIND      VERSION                          REPLACEMENT                REMOVED   DEPRECATED
# my-app-ingress     Ingress   networking.k8s.io/v1beta1        networking.k8s.io/v1       true      true

- name: Check deprecated Kubernetes APIs
  run: |
    helm template ${{ env.RELEASE_NAME }} ./chart | pluto detect --target-versions k8s=v1.27.0 -

# policy/deny_deprecated_ingress.rego
package main

deny[msg] {
  input.apiVersion == "networking.k8s.io/v1beta1"
  input.kind == "Ingress"
  msg := sprintf("DENIED: Ingress '%v' uses removed API networking.k8s.io/v1beta1. Migrate to networking.k8s.io/v1.", [input.metadata.name])
}

helm template my-release ./mychart | conftest test -p policy/ -

# renovate.json
{
  "extends": ["config:base"],
  "helm-values": {
    "fileMatch": ["Chart\\.yaml$"]
  }
}