kyverno: [BUG] Kyverno ignores system namespaces by default

Software version numbers

Kubernetes version: n/a
Kubernetes platform (if applicable; ex., EKS, GKE, OpenShift): n/a
Kyverno version: 1.4.x

Describe the bug

Kyverno ignores the kyverno and the kube-system namespaces in the default resource filter. This means that no policies are applied to these namespaces, which increases security risks.

We need to tighten this, so only "trusted’ resources are ignored or remove the default filters.

Expected behavior

Kyverno installation should be secure by default.

About this issue

Original URL
State: closed
Created 3 years ago
Comments: 20 (14 by maintainers)

Most upvoted comments

Shall we close this issue ?

Everything has been made configurable, we added a documentation page about it. To me it makes sense that kyverno uses safe default values.

eddycharly on Aug 18, 2023

Based on the discussion of Dynamic and Customizable Webhooks , the resourceFilters and namespaceSelectors will be deprecated (see https://github.com/kyverno/kyverno/issues/2320) in the future release. Instead, the webhooks will be configured based on the installed policies. That is to say, there will be no admission request in namespace kube-system forwarded to Kyverno if there isn’t any policy matching the kube-system namespace.

@JimBugwadia - do you see any other potential security issue?

realshuting on Sep 23, 2021

Nothing has changed here AFAIK. Default resourceFilters still look like this:

resourceFilters: '[*,kyverno,*][Event,*,*][*,kube-system,*][*,kube-public,*][*,kube-node-lease,*][Node,*,*][APIService,*,*][TokenReview,*,*][SubjectAccessReview,*,*][SelfSubjectAccessReview,*,*][Binding,*,*][ReplicaSet,*,*][AdmissionReport,*,*][ClusterAdmissionReport,*,*][BackgroundScanReport,*,*][ClusterBackgroundScanReport,*,*][ClusterRole,*,kyverno:*][ClusterRoleBinding,*,kyverno:*][ServiceAccount,kyverno,kyverno][ConfigMap,kyverno,kyverno][ConfigMap,kyverno,kyverno-metrics][Deployment,kyverno,kyverno][Job,kyverno,kyverno-hook-pre-delete][NetworkPolicy,kyverno,kyverno][PodDisruptionBudget,kyverno,kyverno][Role,kyverno,kyverno:*][RoleBinding,kyverno,kyverno:*][Secret,kyverno,kyverno-svc.kyverno.svc.*][Service,kyverno,kyverno-svc][Service,kyverno,kyverno-svc-metrics][ServiceMonitor,kyverno,kyverno-svc-service-monitor][Pod,kyverno,kyverno-test]'

chipzoller on Dec 19, 2022

@eddycharly - please feel free to work on this. Currently I’m a little occupied with a few PSS and platform-side issues.

zeborg on Oct 11, 2022

After discussion in 7/20/22 contributors meeting, I think the best thing here is remove the Namespace filters and move them into the Helm chart as Namespace exclusions.

chipzoller on Jul 21, 2022

meet the same issue in 1.3.3/1.3.6 version, clusterpolicy for kube-system not work as expected.

elvis-cai on Sep 10, 2021