This message was deleted.

im hit with the below issue

kubewarden    kubewarden-controller-7ff847c6fb-gcvzt                  1/1     Running            1 (85m ago)    94m
kubewarden    policy-reporter-58c4c5f7db-zdn8t                        1/1     Running            0              94m
kubewarden    policy-reporter-ui-b85c664dc-d44px                      1/1     Running            0              94m
kubewarden    policy-server-default-6495655d5b-9vwpc                  1/1     Running            0              90m
kubewarden    policy-server-default-7644b7f78f-wzmdx                  0/1     CrashLoopBackOff   14 (99s ago)   48m

the node are updated with root ca. the default policy server is configured with insecuresource field

kind: PolicyServer
metadata:
  annotations:
    <http://meta.helm.sh/release-name|meta.helm.sh/release-name>: kubewarden-defaults
    <http://meta.helm.sh/release-namespace|meta.helm.sh/release-namespace>: kubewarden
  creationTimestamp: "2026-04-06T18:54:23Z"
  finalizers:
  - <http://kubewarden.io/finalizer|kubewarden.io/finalizer>
  generation: 5
  labels:
    <http://app.kubernetes.io/component|app.kubernetes.io/component>: policy-server
    <http://app.kubernetes.io/instance|app.kubernetes.io/instance>: kubewarden-defaults
    <http://app.kubernetes.io/managed-by|app.kubernetes.io/managed-by>: Helm
    <http://app.kubernetes.io/name|app.kubernetes.io/name>: kubewarden-defaults
    <http://app.kubernetes.io/part-of|app.kubernetes.io/part-of>: kubewarden
    <http://app.kubernetes.io/version|app.kubernetes.io/version>: v1.33.1
    <http://helm.sh/chart|helm.sh/chart>: kubewarden-defaults-3.11.1
  name: default
  resourceVersion: "85199"
  uid: df2b17d0-3b00-4566-a100-798cc1415b4f
spec:
  env:
  - name: KUBEWARDEN_LOG_LEVEL
    value: info
  image: <http://registry.example.com/kubewarden/policy-server:v1.33.1|registry.example.com/kubewarden/policy-server:v1.33.1>
  insecureSources:
  - <http://registry.example.com|registry.example.com>
  replicas: 1
  serviceAccountName: policy-server

kind: Request, url: "<http://registry.example.com/v2/kubewarden/policies/pod-privileged/manifests/v1.0.10>", source: hyper_util::client::legacy::Error(Connect, ConnectError("dns error", Custom { kind: Uncategorized, error: "failed to lookup address information: Name does not resolve" })) })))

registry.example.com does not actually exist. You’re supposed to like… use your actual registry there.

sorry @stocky-memory-44492 i mistakenly posted the wrong error. I sanitized the actual registry URL. the issue was related to certs. i use self-signed certs for the registry kubectl logs -n kubewarden -l kubewarden/policy-server=default 2026-04-06T202333.172201Z INFO sigstore:cosignclient builder Cannot parse Rekor public key with id cf1199155bddd051268d1f16ac5c0c75c009f6fb5a63f4177f8e18d7051e3fa0: Pkcs8 spki error : Ecdsa-P256 from der bytes to public key failed: unknown/unsupported algorithm OID: 1.2.840.10045.2.1 2026-04-06T202333.172316Z INFO policy_server:policy downloader policies download download_dir="/tmp" policies_count=1 status="init" 2026-04-06T202333.237232Z ERROR rustls_platform_verifier:verificationothers failed to verify TLS certificate: invalid peer certificate: UnknownIssuer 2026-04-06T202333.239637Z ERROR rustls_platform_verifier:verificationothers failed to verify TLS certificate: invalid peer certificate: UnknownIssuer 2026-04-06T202333.269456Z ERROR rustls_platform_verifier:verificationothers failed to verify TLS certificate: invalid peer certificate: UnknownIssuer 2026-04-06T202333.271895Z ERROR rustls_platform_verifier:verificationothers failed to verify TLS certificate: invalid peer certificate: UnknownIssuer 2026-04-06T202333.271976Z ERROR policy_server:policy downloader policy download failed policy="clusterwide-privileged-pods" error=SourceError(OCIRegistryError(RequestError(reqwest::Error { kind: Request, url: "http://registry.example.ms/v2/kubewarden/policies/pod-privileged/manifests/v1.0.10", source: hyper_util:clientlegacy:Error(Connect, Custom { kind: Other, error: Custom { kind: InvalidData, error: InvalidCertificate(UnknownIssuer) } }) })))