FailedCreate: A controller tried to create a pod and the API server rejected it

FailedCreate on a ReplicaSet, Job, or DaemonSet means pod creation was refused before any pod existed. Because there is no pod to describe, the error is only visible on the controller.

Applies to: All Kubernetes versions

What it means

When a controller creates a pod, the request passes through the same admission path as any other — quota, LimitRange, Pod Security Admission, and every registered webhook. A rejection at that stage means no pod object is ever created, so kubectl get pods shows nothing wrong and kubectl describe pod has nothing to describe. The rejection is recorded as a FailedCreate event on the controller instead, carrying the API server's message verbatim. This is the single most common reason for the confusing situation where a Deployment reports fewer replicas than requested and there is no failing pod to investigate.

Most common causes

• A ResourceQuota in the namespace rejecting the pod.
• A LimitRange rejecting the pod's resource values.
• Pod Security Admission rejecting the pod's security context.
• An admission webhook denying the pod.
• The ServiceAccount named by the pod template not existing.
• The controller's own ServiceAccount lacking permission to create pods.
• A field in the pod template that fails validation.

How to diagnose it

1. Look at the controller, not at pods: kubectl describe replicaset RS -n NAMESPACE, or the Job or DaemonSet.
2. For a Deployment, find its current ReplicaSet first: kubectl get rs -n NAMESPACE --sort-by=.metadata.creationTimestamp.
3. Read the message on the FailedCreate event — it is the API server's own rejection and names the reason.
4. Check quota if the message mentions it: kubectl describe quota -n NAMESPACE.
5. Check the namespace's Pod Security labels if the message names PodSecurity.
6. Confirm the ServiceAccount exists: kubectl get sa -n NAMESPACE.

How to fix it

1. Address whatever the message names — raise the quota, satisfy the security standard, correct the resource values, or create the missing ServiceAccount.
2. Grant the controller's ServiceAccount permission to create pods if that is the block.
3. Fix the pod template rather than the controller — the template is what is being rejected.
4. Reduce the requested replica count temporarily if quota is the constraint and the workload can run smaller.

Notes

The event is on the ReplicaSet, not on the Deployment, so kubectl describe deployment often shows nothing useful. Going one level down to the ReplicaSet is the step that finds the answer, and it is easy to skip.

Related

• exceeded quota — The namespace's ResourceQuota rejected the object
• PodSecurity violation — The pod violates the namespace's security standard

Sources

• Kubernetes documentation — ReplicaSet
• Kubernetes documentation — Resource Quotas
• Kubernetes documentation — Admission Controllers Reference