Individual skill
k8s-kyverno-troubleshooting
Use when Kyverno blocks, changes or fails to police resources in Kubernetes: "admission webhook \"validate.kyverno.svc-fail\" denied the request", "resource ... was blocked due to the following policies", "Policy ... failed" from a ValidatingPolicy, a policy that should block but only reports (Audit), PolicyReports with failures, a policy that is not Ready, mutate or generate rules that do nothing, UpdateRequests stuck, or "failed calling webhook" for kyverno when its pods are down. Covers ClusterPolicy and Policy (kyverno.io) and the CEL policies (policies.kyverno.io). Investigates with kubectl get, describe, events and logs, and proposes fixes. Reads first and asks before changing anything.
skills/k8s-kyverno-troubleshooting/SKILL.md
Source commit 6919c56810a3995714beecedaa8b516db82f41bc
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 5, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 36
- Repository last updated
- Nov 8, 2026
- License
- Apache-2.0
Observed agent integration: claude-code
- agent-skills Repository topic
- claude-code Repository topic
- codex Repository topic
- copilot Repository topic
- kubernetes Repository topic
- sre Repository topic
- ai-agents Repository topic
- claude-skills Repository topic
- devops Repository topic
- gemini-cli Repository topic
- devops Derived category
- security Derived category
- devops-containers Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
.claude-plugin/plugin.jsonasset · 1,065 bytesSKILL.mdcore · 9,911 bytesSKILL.mdcore · 9,911 bytesSKILL.mdcore · 9,911 bytesSKILL.mdcore · 9,911 bytesSKILL.mdcore · 9,911 bytesSKILL.mdcore · 9,911 bytesreferences/mutate-and-generate.mddoc · 2,392 bytesreferences/validation.mddoc · 3,015 bytesreferences/webhooks-and-controllers.mddoc · 3,216 bytes
Read excerpt
# Kyverno troubleshooting
Find out why Kyverno denies, changes or does not police a resource, and propose a fix.
**Read first, ask before changing.** Run the investigation commands freely. Run a
command under an "Ask first" line only after the user approves that exact command; if
your credentials do not allow it, give it to the user to run. Never run a "Proposed
fix"; hand it to the user.
Kyverno runs as admission webhooks plus background controllers. Two policy families
exist side by side:
- **ClusterPolicy and Policy** (`kyverno.io/v1`): rules with `validate`, `mutate`,
`generate` or `verifyImages`. Deprecated in Kyverno 1.19 and planned for removal in
1.20; the API server prints a deprecation warning for them.