Argo CD "admission webhook denied the request" on sync in CI

A cluster admission webhook (a policy engine like Kyverno or OPA Gatekeeper, or a service mesh injector) rejected the object Argo CD applied. The apply fails and the denial message states the rule that blocked it.

What this error means

argocd app sync fails with "error when creating \"<resource>\": admission webhook \"<name>\" denied the request:" followed by the policy message.

error when creating "deploy.yaml": admission webhook "validate.kyverno.svc-fail"
denied the request: validation error: resources must set a memory limit.
rule require-limits failed

Common causes

The resource violates a cluster policy

A validating webhook enforces a rule (limits, labels, signed images) that your manifest does not meet, so the create or update is rejected.

A webhook backend is unreachable and fails closed

If the webhook has failurePolicy: Fail and its service is down, every apply is denied even when the manifest is valid.

How to fix it

Make the manifest satisfy the policy

1. Read the denial message to see which rule and field failed.
2. Update the manifest in Git to meet the policy (add the limit, label, or annotation it requires).
3. Re-sync and confirm the webhook now admits the resource.

resources:
  limits:
    memory: 256Mi
  requests:
    memory: 128Mi

Check the webhook backend if it fails closed

If the policy engine pods are unhealthy, a fail-closed webhook denies everything. Confirm the webhook service is up before assuming the manifest is wrong.

kubectl get pods -n kyverno
kubectl get validatingwebhookconfigurations

How to prevent it

• Run the same policy checks (Kyverno / conftest) in CI before Argo CD applies.
• Keep manifests compliant with cluster admission policies in Git.
• Watch policy-engine health so a fail-closed webhook does not block deploys.

Related guides