GoogleContainerTools/skaffold · error

%s: %s

Error message

%s: %s

What it means

This is a deployment validator error raised when the Kubernetes ReplicaSet controller reports a ReplicaFailure condition with reason FailedCreate caused by an admission webhook rejecting pod creation. Skaffold wraps the webhook's own message so the underlying admission rejection is surfaced verbatim as 'ReplicaFailureAdmissionErr: <webhook message>'.

Source

Thrown at pkg/diag/validator/deployment.go:52

	depObj appsv1.Deployment
}

func NewDeploymentPodsSelector(k kubernetes.Interface, d appsv1.Deployment) PodSelector {
	return &deploymentPodsSelector{k, d}
}

func (s *deploymentPodsSelector) Select(ctx context.Context, ns string, opts metav1.ListOptions) ([]v1.Pod, error) {
	_, _, controller, err := getReplicaSet(&s.depObj, s.k.AppsV1())
	if err != nil {
		log.Entry(ctx).Debugf("could not fetch deployment replica set %s", err)
		return nil, err
	} else if controller == nil {
		log.Entry(ctx).Debugf("deployment replica set not created yet.")
		return nil, nil
	}
	for _, c := range controller.Status.Conditions {
		if c.Type == "ReplicaFailure" && c.Reason == "FailedCreate" && c.Status == "True" && strings.Contains(c.Message, "admission webhook") {
			return nil, fmt.Errorf("%s: %s", ReplicaFailureAdmissionErr, c.Message)
		}
	}

	pods, err := s.k.CoreV1().Pods(ns).List(ctx, opts)
	if err != nil {
		return nil, err
	}
	var filtered []v1.Pod
	for _, po := range pods.Items {
		if isPodOwnedBy(po, controller) {
			filtered = append(filtered, po)
		}
	}
	return filtered, nil
}

View on GitHub (pinned to a1189de023)

Solutions

1. Inspect the wrapped webhook message with kubectl describe rs <name> and fix the policy that rejected the pod (namespace/label selector, resource quota, security context).
2. Check the webhook deployment and service are healthy and reachable: kubectl get validatingwebhookconfigurations/mutatingwebhookconfigurations, then verify the backing service endpoints.
3. Temporarily remove or scope the webhook configuration (e.g. delete the failing webhooks config or add a namespaceSelector exclusion) and redeploy.
4. Ensure the webhook's CA bundle and TLS certs are valid; expired cert-manager/Istio webhook certs are a frequent cause.

Example fix

# before: pods rejected by e.g. Gatekeeper in the target namespace
// after: exempt the namespace in the webhook config
kubectl patch mutatingwebhookconfigurations <name> --type=json -p='[{"op":"add","path":"/webhooks/0/namespaceSelector","value":{"matchExpressions":[{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["dev-ns"]}]}}]'

rs, _ := client.AppsV1().ReplicaSets(ns).Get(ctx, name, metav1.GetOptions{}); for _, c := range rs.Status.Conditions { if c.Type == "ReplicaFailure" && c.Status == "True" { log.Printf("admission will reject: %s", c.Message) } }

func isAdmissionWebhookFailure(err error) bool { return err != nil && strings.Contains(err.Error(), validator.ReplicaFailureAdmissionErr) }

rs, err := v.Select(ctx, ns, deployment); if err != nil { if isAdmissionWebhookFailure(err) { // surface webhook message & fix policy
		return fmt.Errorf("admission webhook rejected pods: %w", err) } return err }

When it happens

Trigger: getDeploymentStatus iterates controller.Status.Conditions and matches Type==ReplicaFailure, Reason==FailedCreate, Status==True, and a Message containing 'admission webhook'; Select then returns the wrapped error.

Common situations: Mutating/validating webhooks (Istio sidecar injection, OPA Gatekeeper, Kyverno, cert-manager) failing or rejecting pods created by a ReplicaSet; webhook service down or misconfigured; PodDisruptionBudget/network policy blocking webhook calls from kube-apiserver.

Related errors

• kubectl apply: %w
• could not fetch deployments: %w
• c.Message (pod status condition message)
• unable to lookup minikube executable. Please add it to PATH
• invalid local-registry-hosting ConfigMap

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/f4694192848d1fd4. Report an issue: GitHub.