-
Story
-
Resolution: Done
-
Undefined
-
None
-
None
-
Strategic Product Work
-
False
-
None
-
False
-
OCPSTRAT-746 - PSa enforcement deliverables in 4.14
-
-
-
Auth - Sprint 240
What
Exclude runtime zero namespaces from pod security admission.
Why
After investigations on managed clusters with regards to the default and kube-system, we found out that the violating workloads are not belonging to OpenShift.
On kube-system, cloud providers run their workloads: https://redhat-internal.slack.com/archives/CB48XQ4KZ/p1689699300541729?thread_ts=1689256615.032909&cid=CB48XQ4KZ.
On default a lot of workloads are being created, when the customer forgot to set a dedicated target namespace.
Adding those namespaces to the ocp namespaces isn't feasible as they are special namespaces (runtime level zero namespaces).
- is related to
-
OCPBUGS-21776 [HyperShift] Runtime zero namespaces are not excluded from pod security in guest cluster
-
- Closed
-