Skip to content

Which Service Account Creates Default Network Policies When Project Network Isolation Is Enabled in Rancher?

Article Number: 000021972

Environment

SUSE Rancher 2.x

Situation

When Project Network Isolation is enabled in Rancher, the system automatically creates a set of default Kubernetes NetworkPolicies in the namespaces associated with the selected project.

In certain environments, it is important to identify the account that creates these policies in order to protect them from unauthorized modifications or deletions.

Resolution

Enabling Project Network Isolation triggers Rancher to use the  cattle service account in the cattle-system namespace of the downstream cluster to create the default network policies.

This service account is the intended and authorized identity for managing these policies as part of Rancher’s automation. Here's the Audit Log snippet that confirms this behavior:

{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"6d498884-6988-4a59-a95b-f7ed3f0f5708","stage":"ResponseComplete","requestURI":"/apis/networking.k8s.io/v1/namespaces/default/networkpolicies","verb":"create","user":{"username":"system:serviceaccount:cattle-system:cattle","uid":"4247a382-3c38-4fc2-8290-f1f386a4a4cd","groups":["system:serviceaccounts","system:serviceaccounts:cattle-system","system:authenticated"]},"sourceIPs":["10.42.83.203"],"userAgent":"rancher/v0.0.0 (linux/amd64) kubernetes/$Format cluster c-m-vqh6d95x","objectRef":{"resource":"networkpolicies","namespace":"default","name":"hn-nodes","apiGroup":"networking.k8s.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":201},"requestObject":{"kind":"NetworkPolicy","apiVersion":"networking.k8s.io/v1","metadata":{"name":"hn-nodes","namespace":"default","creationTimestamp":null,"labels":{"cattle.io/creator":"norman"},"ownerReferences":[{"apiVersion":"v1","kind":"Namespace","name":"default","uid":"fe1d31ad-78fc-405d-9aa3-cb4d055a260a"}]},"spec":{"podSelector":{},"ingress":[{"from":[{"ipBlock":{"cidr":"10.42.123.192/32"}},{"ipBlock":{"cidr":"10.42.83.192/32"}}]}],"policyTypes":["Ingress"]}},"responseObject":{"kind":"NetworkPolicy","apiVersion":"networking.k8s.io/v1","metadata":{"name":"hn-nodes","namespace":"default","uid":"d752f7a8-d632-4113-be09-9659eb14260d","resourceVersion":"9806","generation":1,"creationTimestamp":"2025-08-01T09:16:37Z","labels":{"cattle.io/creator":"norman"},"ownerReferences":[{"apiVersion":"v1","kind":"Namespace","name":"default","uid":"fe1d31ad-78fc-405d-9aa3-cb4d055a260a"}],"managedFields":[{"manager":"rancher","operation":"Update","apiVersion":"networking.k8s.io/v1","time":"2025-08-01T09:16:37Z","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:cattle.io/creator":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"fe1d31ad-78fc-405d-9aa3-cb4d055a260a\"}":{}}},"f:spec":{"f:ingress":{},"f:policyTypes":{}}}}]},"spec":{"podSelector":{},"ingress":[{"from":[{"ipBlock":{"cidr":"10.42.123.192/32"}},{"ipBlock":{"cidr":"10.42.83.192/32"}}]}],"policyTypes":["Ingress"]}},"requestReceivedTimestamp":"2025-08-01T09:16:37.597644Z","stageTimestamp":"2025-08-01T09:16:37.602050Z","annotations":{"authentication.k8s.io/legacy-token":"system:serviceaccount:cattle-system:cattle","authentication.k8s.io/legacy-token-manual-secret":"cattle-token-fkv4v","authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"cattle-admin-binding\" of ClusterRole \"cattle-admin\" to ServiceAccount \"cattle/cattle-system\""}}

As per the log entry, Rancher automatically created a network policy called hn-nodes in the default namespace. It used its internal service account (cattle) to do this.