<p>I created an InitializerConfiguration that adds my initializer for pods.</p>

<p>The documentation says to use a Deployment (<a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#configure-initializers-on-the-fly" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#configure-initializers-on-the-fly</a>). However, doing so results in my initializer Pod being stuck in "pending" because it's waiting for itself to initialize it. I tried overriding the pending initializers to an empty list in the pod spec of the Deployment, but that seems to be ignored.</p>

<p>What's the correct way to deploy a Pod initializer without deadlocking?</p>

<p>I found a couple bug reports that seem related, but no solutions that worked for me:
* <a href="https://github.com/kubernetes/kubernetes/issues/51485" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/51485</a> (based on this one I added the "initialize" verb for pods to the ClusterRole system:controller:replicaset-controller, but that didn't help either)</p>

<blockquote>
  <p>However, doing so results in my initializer Pod being stuck in "pending" because it's waiting for itself to initialize it</p>
</blockquote>

<p>But the docs say:</p>

<blockquote>
  <p>You should first deploy the initializer controller and make sure that it is working properly before creating the <code>initializerConfiguration</code>. Otherwise, any newly created resources will be stuck in an uninitialized state.</p>
</blockquote>

<p>So it sounds to me like you will want to <code>kubectl delete initializerConfiguration --all</code> (or, of course, the specific name of the <code>initializerConfiguration</code>), allow your initializer Pod to start successfully, <strong>then</strong> <code>kubectl create -f my-initializer-config.yaml</code> or whatever.</p>
