Kyverno
Hard
Architecture
All Kyverno admission controller pods are down, and a policy's webhook failurePolicy is Fail. What happens to API requests that its webhook matches?
Select your answer:
Show answer and explanation
Answer: They are rejected until Kyverno is available again
Explanation
Fail is the default. If the API server can't reach the webhook, it rejects the request, which can block deployments across the cluster. Run several admission controller replicas, keep critical namespaces out of scope, or use Ignore for policies where availability matters more than enforcement. The setting lives in spec.webhookConfiguration.failurePolicy; the old spec.failurePolicy field is deprecated.
More hard Kyverno questions
- How does Kyverno change resources that already exist in the cluster, rather than only new admission requests?
- A new generate rule creates a NetworkPolicy in every Namespace. What makes Kyverno also create it in Namespaces that existed before the policy?
- Which label makes Kyverno delete a resource automatically after a set amount of time?
- A Kyverno verifyImages rule has mutateDigest: true. What does it do once the signature is verified?
- In a Kyverno mutate overlay (patchStrategicMerge), what does the +() anchor do, as in '+(imagePullPolicy): IfNotPresent'?
- In a Kyverno validate pattern, what does the X() negation anchor mean, as in 'X(hostPath): "null"'?