Which Service Account Creates Default Network Policies When Project Network Isolation Is Enabled in Rancher?
Article Number: 000021972
Environment
SUSE Rancher 2.x
Situation
When Project Network Isolation is enabled in Rancher, the system automatically creates a set of default Kubernetes NetworkPolicies in the namespaces associated with the selected project.
In certain environments, it is important to identify the account that creates these policies in order to protect them from unauthorized modifications or deletions.
Resolution
Enabling Project Network Isolation triggers Rancher to use the cattle
service account in the cattle-system
namespace of the downstream cluster to create the default network policies.
This service account is the intended and authorized identity for managing these policies as part of Rancher’s automation. Here's the Audit Log snippet that confirms this behavior:
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"6d498884-6988-4a59-a95b-f7ed3f0f5708","stage":"ResponseComplete","requestURI":"/apis/networking.k8s.io/v1/namespaces/default/networkpolicies","verb":"create","user":{"username":"system:serviceaccount:cattle-system:cattle","uid":"4247a382-3c38-4fc2-8290-f1f386a4a4cd","groups":["system:serviceaccounts","system:serviceaccounts:cattle-system","system:authenticated"]},"sourceIPs":["10.42.83.203"],"userAgent":"rancher/v0.0.0 (linux/amd64) kubernetes/$Format cluster c-m-vqh6d95x","objectRef":{"resource":"networkpolicies","namespace":"default","name":"hn-nodes","apiGroup":"networking.k8s.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":201},"requestObject":{"kind":"NetworkPolicy","apiVersion":"networking.k8s.io/v1","metadata":{"name":"hn-nodes","namespace":"default","creationTimestamp":null,"labels":{"cattle.io/creator":"norman"},"ownerReferences":[{"apiVersion":"v1","kind":"Namespace","name":"default","uid":"fe1d31ad-78fc-405d-9aa3-cb4d055a260a"}]},"spec":{"podSelector":{},"ingress":[{"from":[{"ipBlock":{"cidr":"10.42.123.192/32"}},{"ipBlock":{"cidr":"10.42.83.192/32"}}]}],"policyTypes":["Ingress"]}},"responseObject":{"kind":"NetworkPolicy","apiVersion":"networking.k8s.io/v1","metadata":{"name":"hn-nodes","namespace":"default","uid":"d752f7a8-d632-4113-be09-9659eb14260d","resourceVersion":"9806","generation":1,"creationTimestamp":"2025-08-01T09:16:37Z","labels":{"cattle.io/creator":"norman"},"ownerReferences":[{"apiVersion":"v1","kind":"Namespace","name":"default","uid":"fe1d31ad-78fc-405d-9aa3-cb4d055a260a"}],"managedFields":[{"manager":"rancher","operation":"Update","apiVersion":"networking.k8s.io/v1","time":"2025-08-01T09:16:37Z","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:cattle.io/creator":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"fe1d31ad-78fc-405d-9aa3-cb4d055a260a\"}":{}}},"f:spec":{"f:ingress":{},"f:policyTypes":{}}}}]},"spec":{"podSelector":{},"ingress":[{"from":[{"ipBlock":{"cidr":"10.42.123.192/32"}},{"ipBlock":{"cidr":"10.42.83.192/32"}}]}],"policyTypes":["Ingress"]}},"requestReceivedTimestamp":"2025-08-01T09:16:37.597644Z","stageTimestamp":"2025-08-01T09:16:37.602050Z","annotations":{"authentication.k8s.io/legacy-token":"system:serviceaccount:cattle-system:cattle","authentication.k8s.io/legacy-token-manual-secret":"cattle-token-fkv4v","authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"cattle-admin-binding\" of ClusterRole \"cattle-admin\" to ServiceAccount \"cattle/cattle-system\""}}
As per the log entry, Rancher automatically created a network policy called hn-nodes
in the default
namespace. It used its internal service account (cattle
) to do this.