last sync: 2021-May-14 16:08:20 UTC

Azure Policy definition

[Preview]: Kubernetes clusters should not use the default namespace

Name [Preview]: Kubernetes clusters should not use the default namespace
Azure Portal
Id 9f061a12-e40d-4183-a00e-171812443373
Version 2.0.0-preview
details on versioning
Category Kubernetes
Microsoft docs
Description Prevent usage of the default namespace in Kubernetes clusters to protect against unauthorized access for ConfigMap, Pod, Secret, Service, and ServiceAccount resource types. For more information, see https://aka.ms/kubepolicydoc.
Mode Microsoft.Kubernetes.Data
Type BuiltIn
Preview True
Deprecated FALSE
Effect Default: audit
Allowed: (audit, deny, disabled)
Used RBAC Role none
History
Date/Time (UTC ymd) (i) Change type Change detail
2021-03-02 15:11:40 change Major, suffix remains equal (1.0.0-preview > 2.0.0-preview)
2020-12-11 15:42:52 add 9f061a12-e40d-4183-a00e-171812443373
Used in Initiatives none
JSON Changes

JSON
{
  "properties": {
  "displayName": "[Preview]: Kubernetes clusters should not use the default namespace",
    "policyType": "BuiltIn",
    "mode": "Microsoft.Kubernetes.Data",
    "description": "Prevent usage of the default namespace in Kubernetes clusters to protect against unauthorized access for ConfigMap, Pod, Secret, Service, and ServiceAccount resource types. For more information, see https://aka.ms/kubepolicydoc.",
    "metadata": {
      "version": "2.0.0-preview",
      "category": "Kubernetes",
      "preview": true
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
        "displayName": "[Preview]: Effect",
          "description": "'Audit' allows a non-compliant resource to be created or updated, but flags it as non-compliant. 'Deny' blocks the non-compliant resource creation or update. 'Disabled' turns off the policy."
        },
        "allowedValues": [
          "audit",
          "deny",
          "disabled"
        ],
        "defaultValue": "audit"
      },
      "excludedNamespaces": {
        "type": "Array",
        "metadata": {
        "displayName": "[Preview]: Namespace exclusions",
          "description": "List of Kubernetes namespaces to exclude from policy evaluation."
        },
        "defaultValue": [
          "kube-system",
          "gatekeeper-system",
          "azure-arc"
        ]
      },
      "namespaces": {
        "type": "Array",
        "metadata": {
        "displayName": "[Preview]: Namespace inclusions",
          "description": "List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces."
        },
        "defaultValue": [
          
        ]
      },
      "labelSelector": {
        "type": "Object",
        "metadata": {
        "displayName": "[Preview]: Kubernetes label selector",
          "description": "Label query to select Kubernetes resources for policy evaluation. An empty label selector matches all Kubernetes resources."
        },
        "defaultValue": {
          
        }
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "in": [
          "AKS Engine",
          "Microsoft.Kubernetes/connectedClusters",
          "Microsoft.ContainerService/managedClusters"
        ]
      },
      "then": {
      "effect": "[parameters('effect')]",
        "details": {
          "constraintTemplate": "https://store.policy.core.windows.net/kubernetes/block-default-namespace/v1/template.yaml",
          "constraint": "https://store.policy.core.windows.net/kubernetes/block-default-namespace/v1/constraint.yaml",
        "excludedNamespaces": "[parameters('excludedNamespaces')]",
        "namespaces": "[parameters('namespaces')]",
        "labelSelector": "[parameters('labelSelector')]"
        }
      }
    }
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/9f061a12-e40d-4183-a00e-171812443373",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "9f061a12-e40d-4183-a00e-171812443373"
}