RHACS Admission Controller Enforcement Might Not Reject All Non-compliant Requests
Issue
-
The Kubernetes API server occasionally fails to connect to the admission controller.
-
This can cause some non-compliant behaviors to not be rejected as intended by a policy, since the
ValidatingWebhookConfigurationis configured to fail-open in case of errors.
Environment
- Red Hat Advanced Cluster Security for Kubernetes
- Any Kubernetes-based cluster, where connections between kube API server and admission control were recently terminated. This can happen for example when change is rolled out to the admission control deployment that requires pod restarts.
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
