Kubernetes / Cluster Operations, Access & Incident Response
Investigate admission rejection under Pod Security Admission
A workload can be rejected before Pod creation because its requested privileges violate namespace policy. Inspect policy labels and the exact error.
Environment and inputs: Kubernetes · kubectl with supported client/server versions and delegated RBAC. Examples use namespace app unless noted. Check context, namespace, APIs and provider support first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
kubectl get namespace app --show-labelsRead the result
Namespace labels can declare Pod Security enforcement, audit and warning levels. Other admission systems may also apply restrictions.
Resolve and verify
Compare the rejected fields with the appropriate policy version and supported workload design. Reduce unnecessary privileges or obtain a narrowly reviewed exception.
Before changing production
Do not relabel every namespace privileged or disable admission controls to make a deployment succeed.