Webhook

Removing Rancher from a cluster: cattle-system stuck Terminating, clusters that will not delete, the webhook that blocks everything, and getting the admin back

To wipe everything: the rancher-cleanup job and its verify job. For surgery: remove metadata finalizers (patch) and do not force the namespace spec.finalizers without first checking what resources remain; patch finalizers on clusters.provisioning and clusters.management; export and delete the rancher.cattle.io webhooks until the pod is back; reset-password inside the Rancher pod.

Vault Agent Injector on a private GKE cluster: no sidecar and pods take 30 s (the control plane cannot reach the webhook on 8080)

gcloud compute firewall-rules create … –source-ranges= –target-tags= –rules=tcp:8080. Validate by deleting a pod and grepping the injector for ‘handler: Request received: Method=POST URL=/mutate’. Applies to any webhook not listening on 443 or 10250.