Kubernetes "failed to admit pod: admission webhook denied the request": how to find the blocker

TL;DR

The error names the webhook; that name maps to a ValidatingWebhookConfiguration or MutatingWebhookConfiguration. Read its rules and namespace selector to learn what it enforces, then fix your object to comply, or fix the webhook if it is unhealthy.

Verbatim error

Error from server: error when creating "[FILE]": admission webhook "[WEBHOOK-NAME]" denied the request: [POLICY MESSAGE]

Steps

1. Re-run the apply and capture the full error, noting the exact webhook name in quotes.

kubectl apply -f [FILE]

Expected: the error names the webhook, for example validate.[EXAMPLE].io, and often includes the policy message explaining which rule fired.

2. Find the webhook configuration with that name.

kubectl get validatingwebhookconfigurations
kubectl get mutatingwebhookconfigurations
kubectl describe validatingwebhookconfiguration [CONFIG-NAME]

Expected: the config lists webhooks, each with rules (which resources and operations), namespaceSelector, objectSelector, and failurePolicy. Match the denied resource against these rules.

3. Check whether your namespace or object is even supposed to be in scope.

kubectl get namespace [NAMESPACE] --show-labels

Expected: if the webhook uses a namespaceSelector and your namespace lacks the label, the denial is a selector misconfiguration on the webhook side, not your object.

4. Check the health of the webhook service itself.

kubectl get pods -n [WEBHOOK-NAMESPACE] -l app=[WEBHOOK-LABEL]
kubectl get endpoints [WEBHOOK-SERVICE] -n [WEBHOOK-NAMESPACE]

Expected: backing pods Running with ready endpoints. A dead or restarting webhook with failurePolicy Fail blocks every matching request; that is an outage of the webhook, not a policy violation.

5. Fix the right layer. If your object violates policy, edit it to comply and re-apply. If the webhook is broken and blocking the cluster, and you own the webhook, set failurePolicy to Ignore as a temporary measure with the owning team's approval, then repair the webhook and restore Fail.

kubectl patch validatingwebhookconfiguration [CONFIG-NAME] --type=json -p='[{"op":"replace","path":"/webhooks/0/failurePolicy","value":"Ignore"}]'

Expected: applies succeed again. Treat this as incident response, not a permanent fix.

When to use

• kubectl apply or create is rejected with admission webhook denied the request
• The denial started after installing or upgrading a policy controller (OPA Gatekeeper, Kyverno, a service mesh)
• Only some namespaces or resource types are affected

When not to use

• The error is Forbidden from RBAC; that names a user and a verb, not a webhook
• The webhook call times out instead of denying; that is a webhook health or network issue
• You want to exempt a namespace permanently; that is a policy design decision for the webhook owner

Why it happens

Admission webhooks intercept object writes before they persist. A validating webhook can reject anything that breaks its policy, and a mutating webhook can change objects on the way in. Denials mean either your object genuinely violates the policy, or the webhook is misconfigured or unhealthy and failing closed.

Edge cases

• The policy message is empty or generic; check the webhook pod logs, which usually log the exact rule that fired.
• Mutating webhooks can cause denials indirectly by injecting something a later validating webhook rejects; check object state with kubectl get after a dry-run.
• failurePolicy Ignore on a mutating webhook silently skips mutation, which can leave objects half-configured; prefer fixing the webhook.
• Webhook configurations without a namespaceSelector apply cluster-wide, including to kube-system; a bad global webhook can block node and system objects.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_GF1tD8IbllQmSYVZLEX98A