Tekton "TaskRun X failed to create pod" in CI

Tekton tried to create the pod that runs the TaskRun's steps, and the Kubernetes API rejected the create. The reason is a message forwarded from the API, such as a quota or admission denial.

What this error means

A TaskRun is Failed with a pod-create error, for example "failed to create task run pod ... pods 'build-pod' is forbidden: exceeded quota".

Tekton

failed to create task run pod "build-run-pod": pods "build-run-pod" is forbidden: exceeded quota: compute-quota, requested: requests.cpu=2, used: requests.cpu=8, limited: requests.cpu=8

Common causes

A ResourceQuota blocks the pod

The namespace quota has no room for the requested CPU or memory, so the API refuses the pod create.

An admission webhook or PodSecurity policy denies it

A validating webhook, PodSecurity standard, or missing ServiceAccount permission rejects the pod spec Tekton submits.

How to fix it

Fit within the namespace quota

Inspect the quota with kubectl describe resourcequota -n <ns>.
Lower step resource requests or raise the quota.
Re-run once the request fits.

Terminal

kubectl describe resourcequota -n ci

Satisfy PodSecurity and RBAC

Set the step securityContext to match the namespace PodSecurity level, and ensure the run ServiceAccount can create pods.

task.yaml

stepTemplate:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault

How to prevent it

Set realistic resource requests so pods fit the namespace quota.
Align step securityContext with the namespace PodSecurity standard.
Grant the run ServiceAccount pod-create permission via RBAC.