kyverno-troubleshooting

To troubleshoot Kyverno policy violations blocking resource creation, run the diagnostic workflow to identify the blocking ClusterPolicy, review admission webhook denial logs, and verify the policy enforcement status across namespaces and resource kinds.

Kyverno admission webhook denials occur when resources violate active enforce-mode policies; validate the policy status and inspect the specific ClusterPolicy results to identify the misconfiguration causing the deployment failure.

Diagnose Kyverno generate-rule failures by validating the policy status and reviewing the background controller logs to identify why Kyverno fails to mutate or generate resources in the target namespaces.

Audit mode logs Kyverno policy violations without blocking resource creation, while enforce mode actively denies admission requests; checking the policy status determines which mode is causing the observed policy errors.

Yes, you can diagnose Kyverno mutate rules not applying by validating the ClusterPolicy status and tracing the admission webhook processing logic to identify misconfigurations in the policy definitions.

The best way to validate Kyverno ClusterPolicy status during an incident is to run the troubleshooting workflow, which checks policy results and admission webhook errors to quickly remediate enforcement failures.