Hi everyone, I'm pretty new to the whole Kubernetes policy engine scene at my company. We recently started using Kyverno to enforce some basic security rules, and I've hit my first real roadblock.
I have a policy that's blocking a deployment, which is what we want, but I can't figure out *why*. The deployment just fails with a generic "admission webhook" error. When I check the Kyverno pod logs, I see the request come in and get denied, but it doesn't clearly say which rule within my policy actually caused the block. I have a few rules in the same policy for required labels and blocking specific image tags, so it's a guessing game right now.
Here's a simplified version of the policy I'm using:
```
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-labels-block-tags
spec:
rules:
- name: check-for-team-label
match:
resources:
kinds:
- Deployment
validate:
message: "The label `team` is required."
pattern:
metadata:
labels:
team: "?*"
- name: block-latest-tag
match:
resources:
kinds:
- Deployment
validate:
message: "Using the `latest` image tag is not allowed."
pattern:
spec:
template:
spec:
containers:
- image: "!*:latest"
```
Is there a specific way I need to structure the policy or check the logs to see the exact failing rule? Do I need to enable more verbose logging somewhere? Any help would be really appreciated—I feel like I'm missing something obvious. 😅