#17275·kyverno

[Bug] ImageValidatingPolicies Cause Webhook Timeout When Multiple Policies Exist Without matchConditions

Author: gneirinckxCreated Aug 21, 2026Updated Sep 18, 2026

LabelsbugimageVerifywebhooktriagerelease-critical

Kyverno Version

1.19.0

Kubernetes Version

1.35.x

Kubernetes Platform

VMware Tanzu (specify in description)

Kyverno Rule Type

ImageValidatingPolicy

Description

When two or more ImageValidatingPolicy resources exist with identical matchConstraints and no matchConditions defined, Kyverno's admission webhook times out (context deadline exceeded). This completely blocks resource creation and updates.

Workaround: Adding a dummy matchConditions block to at least one policy forces Kyverno to generate separate webhook pathing and resolves the timeout:

yaml

spec:
  matchConditions:
    - name: force-unique-webhook
      expression: "true"

Steps to reproduce

Apply two ImageValidatingPolicy CRDs targeting the same resource rules without matchConditions.
Attempt to create a matching Deployment.
Observe the admission webhook call hanging until it times out after 10 seconds.

Manifests

1. Policy A

yaml

apiVersion: policies.kyverno.io/v1
kind: ImageValidatingPolicy
metadata:
  name: validate-image-policy-a
spec:
  validationActions: [Audit]
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
        operations: ["CREATE", "UPDATE"]
  matchImageReferences:
    - glob: "registry.example.com/private/*"
  validationConfigurations:
    mutateDigest: false
    verifyDigest: false
    required: true
  evaluation:
    admission:
      enabled: true
    background:
      enabled: false
  credentials:
    secrets:
      - regcred
  attestors:
    - name: key-a
      cosign:
        key:
          data: |
            -----BEGIN PUBLIC KEY-----
            [REMOVED - SENSITIVE]
            -----END PUBLIC KEY-----
        ctlog:
          url: https://rekor.sigstore.dev
          insecureIgnoreTlog: true
          insecureIgnoreSCT: true
  validations:
    - expression: >-
        images.containers.map(image, verifyImageSignatures(image, [attestors.key-a])).all(e, e > 0)
      message: "Image signature verification failed for policy A"

2. Policy B

yaml

apiVersion: policies.kyverno.io/v1
kind: ImageValidatingPolicy
metadata:
  name: validate-image-policy-b
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
        operations: ["CREATE", "UPDATE"]
  matchImageReferences:
    - glob: "registry.example.com/private/*"
  validationConfigurations:
    mutateDigest: false
    verifyDigest: false
    required: true
  evaluation:
    admission:
      enabled: true
    background:
      enabled: false
  credentials:
    secrets:
      - regcred
  attestors:
    - name: key-b
      cosign:
        key:
          data: |
            -----BEGIN PUBLIC KEY-----
            [REMOVED - SENSITIVE]
            -----END PUBLIC KEY-----
        ctlog:
          url: https://rekor.sigstore.dev
          insecureIgnoreTlog: true
          insecureIgnoreSCT: true
  validations:
    - expression: >-
        images.containers.map(image, verifyImageSignatures(image, [attestors.key-b])).all(e, e > 0)
      message: "Image signature verification failed for policy B"

3. Test Deployment

yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test
  template:
    metadata:
      labels:
        app: test
    spec:
      containers:
        - name: test
          image: registry.example.com/private/test-image:latest
          command: ['sleep', '3600']

Expected behavior

Expected: Both ImageValidatingPolicy resources evaluate independently in admission control without timing out.
Actual: API server returns an InternalError due to a webhook timeout:

Error from server (InternalError): error when creating "test-deployment.yaml": 
Internal error occurred: failed calling webhook "ivpol.validate.kyverno.svc-fail": 
failed to call webhook: Post "https://kyverno-svc.kyverno.svc:443/ivpol/validate/validate-image-policy-b?timeout=10s": 
context deadline exceeded

Screenshots

No response

Kyverno logs

bash

Slack discussion

No response

Impact & Technical Notes

Aspect	Details
Severity	Critical (Production Blocker)
Trigger Condition	Multiple `ImageValidatingPolicy` resources share identical `matchConstraints.resourceRules` and different `attestors`, but omit `matchConditions`.
Root Cause Hypothesis	Kyverno's webhook path aggregation collapses rules sharing identical `matchConstraints`. Without `matchConditions` to differentiate endpoints, routing collisions stall the execution loop until the 10s API deadline is reached.
Related Issue	Related to [#1519](https://github.com/kyverno/policies/issues/1519) (MutatingPolicy webhook combination issue), but results in hard creation blocks rather than silent failure.

Troubleshooting

I have read and followed the documentation AND the troubleshooting guide.
I have searched other issues in this repository and mine is not recorded.

Source: kyverno/kyverno

View original on GitHub View discussion on GitHub