{"record":{"id":"f4694192848d1fd4","repo":"GoogleContainerTools/skaffold","slug":"s-s","errorCode":null,"errorMessage":"%s: %s","messagePattern":"%s: %s","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/diag/validator/deployment.go","lineNumber":52,"sourceCode":"\tdepObj appsv1.Deployment\n}\n\nfunc NewDeploymentPodsSelector(k kubernetes.Interface, d appsv1.Deployment) PodSelector {\n\treturn &deploymentPodsSelector{k, d}\n}\n\nfunc (s *deploymentPodsSelector) Select(ctx context.Context, ns string, opts metav1.ListOptions) ([]v1.Pod, error) {\n\t_, _, controller, err := getReplicaSet(&s.depObj, s.k.AppsV1())\n\tif err != nil {\n\t\tlog.Entry(ctx).Debugf(\"could not fetch deployment replica set %s\", err)\n\t\treturn nil, err\n\t} else if controller == nil {\n\t\tlog.Entry(ctx).Debugf(\"deployment replica set not created yet.\")\n\t\treturn nil, nil\n\t}\n\tfor _, c := range controller.Status.Conditions {\n\t\tif c.Type == \"ReplicaFailure\" && c.Reason == \"FailedCreate\" && c.Status == \"True\" && strings.Contains(c.Message, \"admission webhook\") {\n\t\t\treturn nil, fmt.Errorf(\"%s: %s\", ReplicaFailureAdmissionErr, c.Message)\n\t\t}\n\t}\n\n\tpods, err := s.k.CoreV1().Pods(ns).List(ctx, opts)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tvar filtered []v1.Pod\n\tfor _, po := range pods.Items {\n\t\tif isPodOwnedBy(po, controller) {\n\t\t\tfiltered = append(filtered, po)\n\t\t}\n\t}\n\treturn filtered, nil\n}\n","sourceCodeStart":34,"sourceCodeEnd":68,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/diag/validator/deployment.go#L34-L68","documentation":"This is a deployment validator error raised when the Kubernetes ReplicaSet controller reports a ReplicaFailure condition with reason FailedCreate caused by an admission webhook rejecting pod creation. Skaffold wraps the webhook's own message so the underlying admission rejection is surfaced verbatim as 'ReplicaFailureAdmissionErr: <webhook message>'.","triggerScenarios":"getDeploymentStatus iterates controller.Status.Conditions and matches Type==ReplicaFailure, Reason==FailedCreate, Status==True, and a Message containing 'admission webhook'; Select then returns the wrapped error.","commonSituations":"Mutating/validating webhooks (Istio sidecar injection, OPA Gatekeeper, Kyverno, cert-manager) failing or rejecting pods created by a ReplicaSet; webhook service down or misconfigured; PodDisruptionBudget/network policy blocking webhook calls from kube-apiserver.","solutions":["Inspect the wrapped webhook message with kubectl describe rs <name> and fix the policy that rejected the pod (namespace/label selector, resource quota, security context).","Check the webhook deployment and service are healthy and reachable: kubectl get validatingwebhookconfigurations/mutatingwebhookconfigurations, then verify the backing service endpoints.","Temporarily remove or scope the webhook configuration (e.g. delete the failing webhooks config or add a namespaceSelector exclusion) and redeploy.","Ensure the webhook's CA bundle and TLS certs are valid; expired cert-manager/Istio webhook certs are a frequent cause."],"exampleFix":"# before: pods rejected by e.g. Gatekeeper in the target namespace\n// after: exempt the namespace in the webhook config\nkubectl patch mutatingwebhookconfigurations <name> --type=json -p='[{\"op\":\"add\",\"path\":\"/webhooks/0/namespaceSelector\",\"value\":{\"matchExpressions\":[{\"key\":\"kubernetes.io/metadata.name\",\"operator\":\"NotIn\",\"values\":[\"dev-ns\"]}]}}]'","handlingStrategy":"try-catch","validationCode":"rs, _ := client.AppsV1().ReplicaSets(ns).Get(ctx, name, metav1.GetOptions{}); for _, c := range rs.Status.Conditions { if c.Type == \"ReplicaFailure\" && c.Status == \"True\" { log.Printf(\"admission will reject: %s\", c.Message) } }","typeGuard":"func isAdmissionWebhookFailure(err error) bool { return err != nil && strings.Contains(err.Error(), validator.ReplicaFailureAdmissionErr) }","tryCatchPattern":"rs, err := v.Select(ctx, ns, deployment); if err != nil { if isAdmissionWebhookFailure(err) { // surface webhook message & fix policy\n\t\treturn fmt.Errorf(\"admission webhook rejected pods: %w\", err) } return err }","preventionTips":["Test webhook policies (Gatekeeper/Kyverno constraints) against dev namespaces before enforcing cluster-wide","Keep webhook certs and CA bundles rotated (cert-manager self-checks)","Add namespaceSelector exemptions for system and CI namespaces","Monitor webhook failurePolicy and consider failurePolicy: Ignore for non-critical webhooks"],"tags":["kubernetes","deployment","admission-webhook","replicaset"],"backgroundTag":"admission-webhook-denied","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}