# All Kyverno admission controller pods are down, and a policy's webhook failurePolicy is Fail. What happens to API requests that its webhook matches?

Kyverno, Hard (Expert), Architecture. https://k8wiz.com/uquiz/all-kyverno-admission-controller-pods-are-down-and-a-policys-webhook-failurepolicy-is-fail-what-happens-to-api-requests-that-its

- A. They are allowed and checked later by a background scan
- B. They are queued until Kyverno comes back
- C. The API server skips Kyverno and evaluates the policy itself
- D. They are rejected until Kyverno is available again

**Answer:** They are rejected until Kyverno is available again

**Explanation:** Fail is the default. If the API server can't reach the webhook, it rejects the request, which can block deployments across the cluster. Run several admission controller replicas, keep critical namespaces out of scope, or use Ignore for policies where availability matters more than enforcement. The setting lives in spec.webhookConfiguration.failurePolicy; the old spec.failurePolicy field is deprecated.