Install a ValidatingAdmissionPolicy, on by default in managed and
operator workspace modes, that matches only the gateway ServiceAccount.
It admits Secret, Pod, Sandbox, Service, ServiceAccount, and
NetworkPolicy writes only in namespaces labeled as owned by this
gateway and namespaces matching the operator selector. Secret writes are
also admitted in the credential namespace when the Kubernetes Secrets
credential driver is enabled. Namespace writes are admitted only for
namespaces owned by this gateway, judged by their existing labels.
- Skip rendering the policy when rbac.create or rbac.clusterScoped.create
is false; a cluster-admin applies it with the other cluster-scoped
objects.
- Require Kubernetes 1.30.
- Fail rendering with operatorNamespaceFile or set-based operator
selectors, which the policy cannot evaluate. admissionPolicy.enabled
set to false opts out.
- Add e2e checks in managed and operator modes that send server-side
dry-run requests as the gateway ServiceAccount outside its namespaces,
including Pod creation in the sandbox and credential namespace, and
assert the policy rejects them.
- Document the policy and opt-out, raise the minimum Kubernetes version
in the docs and support matrix, and add policy denials to the cluster
debugging skill.
Signed-off-by: Kris Hicks <khicks@nvidia.com>
Kris Hicks
7d843b32c2