Flux Kustomization "dry-run failed" admission webhook in CI

kustomize-controller runs a server-side dry-run before applying, and an admission webhook denied the request. A policy controller or validating webhook rejected a manifest, so Flux stops before making changes.

What this error means

A Kustomization reports "False" with "dry-run failed" and an "admission webhook ... denied the request" message from a policy or validating webhook.

dry-run failed: admission webhook "validation.gatekeeper.sh" denied the request: container must set resources.limits

Common causes

A policy webhook rejects the manifest

A policy controller (Gatekeeper, Kyverno) enforces a rule the manifest violates, so the dry-run is denied.

The webhook is unreachable or misconfigured

A failing webhook with failurePolicy: Fail denies every request, including Flux's dry-run, until the webhook is healthy.

How to fix it

Make the manifest satisfy the policy

1. Read the webhook message to see which rule was violated.
2. Update the manifest to comply (add the required field or label).
3. Reconcile the Kustomization so the dry-run passes.

flux reconcile kustomization apps --with-source
kubectl -n flux-system describe kustomization apps

Fix an unhealthy webhook

If the webhook itself is down, restore the policy controller so it stops denying every dry-run.

kubectl get validatingwebhookconfigurations
kubectl -n gatekeeper-system get pods

How to prevent it

• Test manifests against your admission policies before merging.
• Keep policy controllers healthy so dry-run is not blocked wholesale.
• Scope failurePolicy carefully so a webhook outage does not halt all deploys.

Related guides