Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

6.2. Custom security policies

In addition to using the default policies, you can also create custom policies in Red Hat Advanced Cluster Security for Kubernetes.

You can create custom policies by using the following methods:

  • In the RHACS portal, go to Platform configuration Policy management and click Create policy.
  • In the RHACS portal, go to Risk and use the filter to select the criteria that you want the policy to use. Click Create policy.
  • Create and manage policies as code by saving policies as Kubernetes custom resources (CRs) and by applying them to clusters using a continuous delivery tool such as Argo CD.

See the following sections for more information.

You can create new security policies from the system policies view.

Procedure

  1. In the RHACS portal, go to Platform Configuration Policy Management.
  2. Click Create policy.
  3. Configure the policy definition information in the following sections.

6.2.1.1. Adding logical conditions for the policy criteria
复制链接

You can use the drag-and-drop policy fields panel to specify logical conditions for the policy criteria.

Prerequisites

  • You must be using Red Hat Advanced Cluster Security for Kubernetes version 3.0.45 or newer.

Procedure

  1. In the Policy Criteria section, select Add a new condition to add a new policy section.

    • You can click on the Edit icon to rename the policy section.
    • The Drag out a policy field section lists available policy criteria in multiple categories. You can expand and collapse these categories to view the policy criteria attributes.
  2. Drag an attribute to the Drop a policy field inside area of the policy section.

  3. Depending on the type of the attribute you select, you get different options to configure the conditions for the selected attribute. For example:

    • If you select an attribute with Boolean values Read-Only Root Filesystem, you will see READ-ONLY and WRITABLE options.

    • If you select an attribute with compound values Environment variable, you will see options to enter values for Key, Value, and Value From fields, and an icon to add more values for the available options.

      1. To combine multiple values for an attribute, click the Add icon.
      2. You can also click on the logical operator AND or OR listed in a policy section, to toggle between AND and OR operators. Toggling between operators only works inside a policy section and not between two different policy sections.
  4. You can specify more than one AND and OR condition by repeating these steps. After you configure the conditions for the added attributes, click Next to continue with the policy creation.

6.2.2. Creating a security policy from the risk view
复制链接

While evaluating risks in your deployments in the Risk view, when you apply local page filtering, you can create new security policies based on the filtering criteria you are using.

Procedure

  1. Go to the RHACS portal and select Risk from the navigation menu.
  2. Apply local page filtering criteria that you want to create a policy for.
  3. Select New Policy and complete the required fields to create a new policy. For the steps to create a policy, see "Creating a security policy from the system policies view".

6.2.3. Modifying existing security policies
复制链接

You can edit the policies you have created and the existing default policies provided by Red Hat Advanced Cluster Security for Kubernetes that you have cloned.

Procedure

  1. In the RHACS portal, go to Platform Configuration Policy Management.
  2. From the Policies page, select the policy you want to edit.

  3. Select Actions Edit policy.

    注意

    You cannot edit default policies. You must clone a default policy and edit the cloned policy.

  4. Edit the fields that you want to change and click Save.

6.2.3.1. Disabling associated policies
复制链接

You can turn off the enforcement on relevant policies, which in turn instructs the admission controller to skip enforcements.

Procedure

  1. In the RHACS portal, go to Platform Configuration Policy Management.

  2. Disable enforcement on the default policies:

    • In the policies view, locate the Kubernetes Actions: Exec into Pod policy. Click the overflow menu, kebab , and then select Disable policy.
    • In the policies view, locate the Kubernetes Actions: Port Forward to Pod policy. Click the overflow menu, kebab , and then select Disable policy.
  3. Disable enforcement on any other custom policies that you have created by using criteria from the default Kubernetes Actions: Port Forward to Pod and Kubernetes Actions: Exec into Pod policies.
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

Legal Notice

Theme

© 2026 Red Hat返回顶部