Kubernetes Gatekeeper/OPA Policy Violation - Fix Constraint Denials in CI

By Daniel Zoghalchali·Latchkey

A policy controller (Gatekeeper/OPA or Kyverno) evaluated your object against a constraint and rejected it. Unlike a generic webhook denial, the message names the specific constraint and the rule it enforces - required labels, an allowed-registry list, mandatory limits.

What this error means

kubectl apply fails with admission webhook "validation.gatekeeper.sh" denied the request: [<constraint-name>] <reason> (or a Kyverno policy <name> ... blocked). The reason is the constraint’s own message, deterministic for the same object and policy set.

kubectl output

Error from server: admission webhook "validation.gatekeeper.sh" denied the
request: [allowed-repos] container <api> has an invalid image repo <docker.io/x>,
allowed repos are ["registry.internal/"]

Common causes

Object violates a specific constraint

A Gatekeeper Constraint (e.g. K8sAllowedRepos, K8sRequiredLabels) or a Kyverno ClusterPolicy requires/forbids something your manifest does not satisfy - a registry, a label, a limit.

A new or tightened policy

A constraint was added or moved from dryrun/warn to deny, so a manifest that passed before now fails. The policy changed, not your YAML.

How to fix it

Find the constraint and its rule

List constraints (Gatekeeper) or policies (Kyverno) and read the one the message names.

Terminal

kubectl get constraints                 # Gatekeeper
kubectl get constrainttemplates
kubectl get cpol,pol -A                  # Kyverno

Make the manifest compliant

Satisfy the constraint - use an allowed registry, add the required label, set the mandated limits.
Re-apply and confirm the constraint now admits it.
If the policy is wrong, change the Constraint/Policy with its owner; do not disable enforcement to ship.

How to prevent it

Run constraints/policies in CI (gator test, conftest, kyverno CLI) before apply.
Keep manifests aligned with the org policy set in version control.
Roll out new constraints in warn/dryrun first, then enforce after teams adapt.

Frequently asked questions

What causes "OPA/Gatekeeper denied"?