From f183d7f8dcd31f030669610967ab1997c856fb92 Mon Sep 17 00:00:00 2001 From: swaphb Date: Mon, 10 Aug 2026 18:02:40 -0400 Subject: [PATCH] document default namespace policy scope --- policies/README.md | 7 +++++++ policies/kyverno/disallow-default-namespace.yaml | 3 +++ 2 files changed, 10 insertions(+) diff --git a/policies/README.md b/policies/README.md index 943169a..e4efe55 100644 --- a/policies/README.md +++ b/policies/README.md @@ -20,6 +20,13 @@ existing objects. | `disallow-default-namespace` | Supplemental | Blocks common application resources from being created in `default`, which makes namespace ownership explicit. | | `disallow-host-network` | 5.2.3 and 5.2.5 | Rejects host PID, host network, and host IPC access. | +The default-namespace policy intentionally excludes ConfigMaps and Secrets. +Those objects are supporting data, not application entrypoints, and blocking +them alone would not prevent a workload from being installed. Keeping them out +also avoids adding broad read permissions for Secret data to Kyverno's reports +controller. Applications should create these objects in the same explicitly +named namespace as the workloads that consume them. + The CIS benchmark includes manual checks and platform-specific exceptions. The mapping above describes the control objective each policy supports, not a claim that one Kyverno rule implements the entire benchmark control. diff --git a/policies/kyverno/disallow-default-namespace.yaml b/policies/kyverno/disallow-default-namespace.yaml index dfcb8e9..d8969c8 100644 --- a/policies/kyverno/disallow-default-namespace.yaml +++ b/policies/kyverno/disallow-default-namespace.yaml @@ -8,6 +8,9 @@ metadata: policies.kyverno.io/severity: medium # Supplemental namespace-isolation control. This is not a one-to-one CIS control. policies.kyverno.io/cis-control: "supplemental" + # ConfigMaps and Secrets are intentionally excluded. They are supporting + # data rather than application entrypoints, and matching Secrets would also + # require broader Kyverno reports-controller read permissions. spec: validationFailureAction: Enforce background: false