kubectl "admission webhook denied the request" - Fix in CI

A validating admission webhook intercepted your create/update and refused it. The object reached the API server fine - a policy controller (Gatekeeper, Kyverno, a built-in webhook) judged it non-compliant and returned the denial message.

What this error means

kubectl apply fails with Error from server: admission webhook "<name>" denied the request: <reason>. The reason is policy text - a required label, a banned setting, a registry allow-list. It is deterministic for the same object and policy.

kubectl output

Error from server: error when creating "deploy.yaml": admission webhook
"validation.gatekeeper.sh" denied the request: [require-team-label] you must
provide a "team" label

Common causes

The object violates a cluster policy

A Gatekeeper constraint, Kyverno policy, or built-in webhook requires (or forbids) something - a label, a non-root securityContext, a specific registry - and your manifest does not comply.

A policy changed under you

A manifest that applied last week now fails because a new or tightened policy was rolled out. The webhook, not your YAML, is what changed.

How to fix it

Read the denial reason and the policy

The message after "denied the request:" is the rule. Find the webhook configuration and the constraint behind it.

Terminal

kubectl get validatingwebhookconfigurations
kubectl get constraints   # Gatekeeper
kubectl get cpol,pol -A   # Kyverno

Make the manifest compliant

Add the required field/label or remove the forbidden setting the message names.
Re-apply and confirm the webhook now admits it.
If the policy itself is wrong, fix the constraint with the policy owner - do not bypass the webhook.

How to prevent it

Run cluster policies (Gatekeeper/Kyverno) in a CI dry-run or with conftest before apply.
Keep manifests aligned with the org policy set in version control.
Coordinate policy rollouts so teams update manifests before enforcement tightens.