kubectl "admission webhook denied the request" - Fix in CI

By Kaveh Alemi·Latchkey

A validating admission webhook intercepted your create/update and refused it. The object reached the API server fine - a policy controller (Gatekeeper, Kyverno, a built-in webhook) judged it non-compliant and returned the denial message.

What this error means

kubectl apply fails with Error from server: admission webhook "<name>" denied the request: <reason>. The reason is policy text - a required label, a banned setting, a registry allow-list. It is deterministic for the same object and policy.

kubectl output

Error from server: error when creating "deploy.yaml": admission webhook
"validation.gatekeeper.sh" denied the request: [require-team-label] you must
provide a "team" label

Diagnose it: read events, not just status

A deployment that never becomes ready has the reason in its events and in the pod state, not in the deployment status. Read both before changing the manifest.

Terminal

kubectl rollout status deploy/<name> --timeout=120s
kubectl describe deploy/<name> | sed -n "/Events/,$p"
kubectl get pods -l app=<name> -o wide
kubectl describe pod <pod> | sed -n "/Events/,$p"
kubectl logs <pod> --previous --tail=50   # the crash before the restart

Common causes

The object violates a cluster policy

A Gatekeeper constraint, Kyverno policy, or built-in webhook requires (or forbids) something - a label, a non-root securityContext, a specific registry - and your manifest does not comply.

A policy changed under you

A manifest that applied last week now fails because a new or tightened policy was rolled out. The webhook, not your YAML, is what changed.

How to fix it

Read the denial reason and the policy

The message after "denied the request:" is the rule. Find the webhook configuration and the constraint behind it.

Terminal

kubectl get validatingwebhookconfigurations
kubectl get constraints   # Gatekeeper
kubectl get cpol,pol -A   # Kyverno

Make the manifest compliant

Add the required field/label or remove the forbidden setting the message names.
Re-apply and confirm the webhook now admits it.
If the policy itself is wrong, fix the constraint with the policy owner - do not bypass the webhook.

How to prevent it

Run cluster policies (Gatekeeper/Kyverno) in a CI dry-run or with conftest before apply.
Keep manifests aligned with the org policy set in version control.
Coordinate policy rollouts so teams update manifests before enforcement tightens.

Frequently asked questions

What causes kubectl "admission webhook denied the request"?

There are 2 common causes: the object violates a cluster policy and a policy changed under you. A Gatekeeper constraint, Kyverno policy, or built-in webhook requires (or forbids) something - a label, a non-root securityContext, a specific registry - and your manifest does not comply.

How do I fix kubectl "admission webhook denied the request"?

There are 2 fixes depending on which cause you have: read the denial reason and the policy and make the manifest compliant. Work through them in order, since the first is the most common.

What does kubectl "admission webhook denied the request" actually mean?

kubectl apply fails with Error from server: admission webhook "<name>" denied the request: <reason>.

How do I stop kubectl "admission webhook denied the request" happening again?

Run cluster policies (Gatekeeper/Kyverno) in a CI dry-run or with conftest before apply. The prevention section lists 3 changes that keep it from recurring.