Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

5.4. Disabling admission controller enforcement

You can disable admission controller enforcement on a cluster when installing RHACS. For clusters that you did not install by using the Operator or Helm, you can disable admission controller enforcement from the Clusters view on the Red Hat Advanced Cluster Security for Kubernetes (RHACS) portal.

Procedure

  1. For a cluster that was installed by using the Operator, in the SecuredCluster custom resource (CR), edit the spec.admissionControl.enforcement parameter to Disabled.

  2. For a cluster that was installed by using Helm, in the values-public.yaml file, set the admissionControl.enforce value to false and run the following command: 

    helm upgrade -n stackrox \
  stackrox-secured-cluster-services rhacs/secured-cluster-services \
  --reuse-values \
  -f /config/yaml/values-public.yaml \
  -f /config/yaml/values-private.yaml

  3. For clusters that are not managed by the Operator or Helm, you can use the RHACS portal to change this setting:

    1. In the RHACS portal, select Platform Configuration Clusters.
    2. Select an existing cluster from the list.

    3. In the Dynamic configuration section, in the Admission controller enforcement behavior field, select one of the following options:

      • Enforce policies: The admission controller enforces policies that are configured for enforcement by rejecting the workload admission or update attempt.
      • No enforcement: Even if enforcement is configured for a policy, if this option is selected, the admission controller does not enforce the policy and allows workload admission attempts or updates that violate the policy.
    4. Select Next.
    5. Select Finish.

5.4.1. Disabling associated policies
复制链接

You can turn off the enforcement on relevant policies, which in turn instructs the admission controller to skip enforcements.

Procedure

  1. In the RHACS portal, go to Platform Configuration Policy Management.

  2. Disable enforcement on the default policies:

    • In the policies view, locate the Kubernetes Actions: Exec into Pod policy. Click the overflow menu, kebab , and then select Disable policy.
    • In the policies view, locate the Kubernetes Actions: Port Forward to Pod policy. Click the overflow menu, kebab , and then select Disable policy.
  3. Disable enforcement on any other custom policies that you have created by using criteria from the default Kubernetes Actions: Port Forward to Pod and Kubernetes Actions: Exec into Pod policies.

5.4.2. Disabling the webhook
复制链接

You can disable admission controller enforcement from the Clusters view in the RHACS portal.

重要

If you disable the admission controller by turning off the webhook, you must redeploy the Sensor bundle.

Procedure

  1. In the RHACS portal, go to Platform Configuration Clusters.
  2. Select an existing cluster from the list.
  3. Turn off the Enable Admission Controller Webhook to listen on exec and port-forward events toggle in the Static Configuration section.
  4. Select Next to continue with Sensor setup.
  5. Click Download YAML file and keys.

  6. From a system that has access to the monitored cluster, extract and run the sensor script: 

    $ unzip -d sensor sensor-<cluster_name>.zip
     
    $ ./sensor/sensor.sh
    注意

    If you get a warning that you do not have the required permissions to deploy the sensor, follow the on-screen instructions, or contact your cluster administrator for help.

    After the sensor is deployed, it contacts Central and provides cluster information.

  7. Return to the RHACS portal and check if the deployment is successful. If it is successful, a green checkmark appears under section #2. If you do not see a green checkmark, use the following command to check for problems:

    • On OpenShift Container Platform: 

      $ oc get pod -n stackrox -w

    • On Kubernetes: 

      $ kubectl get pod -n stackrox -w
  8. Select Finish.
注意

When you disable the admission controller, RHACS does not delete the ValidatingWebhookConfiguration parameter. However, instead of checking requests for violations, it accepts all AdmissionReview requests.

To remove the ValidatingWebhookConfiguration object, run the following command in the secured cluster:

  • On OpenShift Container Platform: 

    $ oc delete ValidatingWebhookConfiguration/stackrox

  • On Kubernetes: 

    $ kubectl delete ValidatingWebhookConfiguration/stackrox
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

Legal Notice

Theme

© 2026 Red Hat返回顶部