← Problem Library
Security L7 SECURITY-1327 · 15 min

An admission policy rollout breaks only one namespace

Most workloads admit fine, yet one namespace still fails because the namespace-scoped injection path has not propagated the new trust bundle.

SecurityPlatform ReliabilityLevel 7Pro15 min
Scenario

A webhook signer rotates and only one subset of the cluster begins rejecting admissions with certificate trust errors.

What to check first
  • Identify the primary failure signal in the The Cluster Trusted the New Signer Before One Injection Path Did scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Check each trust injection path separately before regenerating certificates again.

Questions worth viewing together
What should you verify first when An admission policy rollout breaks only one namespace appears?

Community-field security problem inspired by Kubernetes community trust-rotation incidents where one CABundle injection path lagged behind the new signer. Distributed trust injection systems rarely converge everywhere at the same instant.

What usually causes An admission policy rollout breaks only one namespace in production?

Teams often blame the certificate secret when the lagging component is the CABundle injection controller.

What should you document after resolving An admission policy rollout breaks only one namespace?

Webhook trust rotation should validate every namespace or scope-specific injection path, not only the global one.