Kubernetes "admission webhook ... denied the request" in CI - Fix it

A validating admission webhook (OPA Gatekeeper, Kyverno, or a built-in policy) intercepted the apply and rejected it. The deploy is not broken syntactically; it breaks a rule the cluster enforces, and the webhook message states which rule.

What this error means

A kubectl apply fails with Error from server: admission webhook "validation.gatekeeper.sh" denied the request: <reason>, naming the policy that was violated.

Error from server: error when creating "deploy.yaml": admission webhook
"validation.gatekeeper.sh" denied the request: container "api" must set
resources.limits.memory

Common causes

The manifest violates an enforced policy

A policy controller requires something (resource limits, a label, a non-root user, a registry allowlist) that the manifest does not satisfy.

A new or tightened policy on the cluster

A manifest that previously passed now fails because the cluster added or tightened an admission policy.

How to fix it

Read the denial reason and make the manifest compliant

1. Read the exact rule in the webhook message.
2. Add the required field (limits, label, securityContext) to the manifest.
3. Re-apply once it satisfies the policy.

resources:
  limits:
    memory: "512Mi"

Test manifests against policies before deploy

A server-side dry run runs admission webhooks without persisting, surfacing the denial in CI before the real apply.

kubectl apply -f deploy.yaml --dry-run=server

How to prevent it

• Run a server-side dry run so policy denials surface early.
• Keep manifests aligned with the cluster's admission policies.
• Coordinate policy changes with the teams whose manifests they affect.

Related guides