---
# System prepended metadata

title: OPA Gatekeeper Issue

---

# OPA Gatekeeper Issue

## Enabling Mutating Webhook causes a problem in case of resource state change
^^ kararlastiralim

**What steps did you take and what happened:**

- We enabled a mutating feature of `OPA Gatekeeper` via flag `--enable-mutation=true`
- Once all the worker nodes restarted on purpose, we encountered a problem: We couldn't reach the `Kube API Server` even though all the Kube API Server resources have been **up and running** due to _creating/updating/deleting_ resources
- All the replicas of the `OPA Gatekeeper` went into the `CrashLoopBackOff` state
- We couldn't fetch the logs of the pods, we got an error something like the following:
```shell
Error from server (InternalError): Internal error occurred: Authorization Error (user=kube-apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy
```

**What did you expect to happen:**

It should work?

**Anything else you would like to add:**

We applied all the manifest [as described in the documentation](https://open-policy-agent.github.io/gatekeeper/website/docs/install/#deploying-a-release-using-prebuilt-image):

```bash
$ kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.5/deploy/gatekeeper.yaml
```


**Environment:**

- Gatekeeper version: v3.4.0
- Kubernetes version: (use `kubectl version`): v1.16.11