Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →If a custom resource is rejected as unknown shortly after its CRD is installed, check whether Kyverno’s resource-discovery view has caught up. A 2024 report in Kyverno issue #10729 describes that failure when a policy with wildcard kind matching was already active; waiting for discovery to refresh or rolling Kyverno reportedly restored recognition. This is a version- and setup-specific report, not a guarantee that every Kyverno release behaves the same way.
First identify what “wildcard guardrail” means
Inspect the policy before changing anything. A policy whose match.resources.kinds contains * uses wildcard kind matching: it can select resource types for Kyverno policy evaluation. A policy that forbids * in an RBAC Role or ClusterRole’s resources list is instead restricting wildcard permissions. These are different configurations; Kyverno’s policy library documents the latter separately in its wildcard RBAC resources policy.
As an Amazon Associate I earn from qualifying purchases.
Why a newly installed CRD may be rejected
A Kubernetes API server can have a CRD while Kyverno’s resource-discovery cache has not yet learned the custom resource’s mapping. In issue #10729, the reporter said the CRD was present, but a create request for its custom resource was rejected because Kyverno could not find the resource mapping. The report linked the failure to a wildcard-kind policy already running when the CRD was installed.
Recommended Free Tools
The issue reporter observed a 15-minute cache invalidation or resync interval in the code context they examined. That number describes the reported context; it is not a current, Kyverno-wide refresh guarantee. Kyverno’s behavior can depend on the deployed version and configuration.
#1 Best Overall
What to check before changing Kyverno
- Capture the deployment details. Record Kyverno and Kubernetes versions, how Kyverno was installed, which controller handles the admission request, the exact rejection, and relevant controller logs.
- Read the policy match. Check whether
match.resources.kindsuses a wildcard. If the guardrail actually prohibits wildcard RBAC permissions, investigate that policy separately. - Verify the CRD and requested type. Confirm the CRD is established, the intended group and version are served, and the request’s group, version, and kind (GVK) match the CRD. A CRD visible to Kubernetes does not, by itself, establish that Kyverno’s discovery view has refreshed.
- Compare the failure with the report. Look for an unknown-resource or missing-mapping error in the admission response and Kyverno logs. The issue describes this pattern, but matching symptoms alone do not prove the same cause.
- Retry after an appropriate recovery action. If the case appears to match issue #10729, the reporter found that waiting for discovery to refresh or rolling Kyverno restored recognition. Treat a restart as a reported operational workaround, not proof of root cause or a universal fix; check logs and retest on your deployed version.
Choose between broader coverage and narrower matching
Kyverno supports wildcard matching in the kinds field, with forms such as Group/*/Kind, Group/*/*, */Kind, and *. Its resource-selection documentation warns that broad matching can send every eligible resource type to Kyverno and increase processing. Use the narrowest explicit group, version, and kind scope that still meets the policy’s purpose.
| Approach | Policy coverage | Recognition of a new custom resource | Processing and operational trade-off |
|---|---|---|---|
| Keep wildcard kinds | Broad; can include eligible resource types beyond the currently known set. | The issue report describes a delay until discovery refreshed when a CRD was added after Kyverno was running. | Kyverno cautions that broad matching can increase processing. Waiting avoids a restart but leaves the resource unrecognized until discovery catches up. |
| Use specific group, version, and kind values where feasible | Narrower and explicit; only the scoped types are selected. | The issue reporter listed narrowing wildcard kinds as a workaround; confirm behavior for the installed version. | Reduces unnecessary broad selection, but new types require policy scope to be considered and updated as needed. |
| Roll Kyverno after adding the CRD | Does not change the policy’s matching scope. | The reporter said a restart rebuilt the cache and restored recognition in their setup. | Introduces an operational rollout and its associated risk; validate controller health and retry rather than treating restart as guaranteed remediation. |
What the report does—and does not—establish
Issue #10729 is evidence of a reported failure mode and reported workarounds in a particular historical context. It does not establish that all Kyverno versions use a 15-minute refresh cycle, that every wildcard policy triggers the same denial, or that a rollout restart is required for every newly installed CRD. Check the version-specific behavior in your cluster and confirm recovery by retrying the intended custom-resource request.
Kyverno also defines its own custom resource types for policies, reports, and related functions. For inspecting installed Kyverno types, its resource-definition documentation recommends kubectl explain: Kyverno resource definitions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
