Skip to content

Which Service Account Creates Default Network Policies When Project Network Isolation Is Enabled in Rancher?

This document (000021972) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Rancher 2.x

Situation

When Project Network Isolation is enabled in Rancher, the system automatically creates a set of default Kubernetes NetworkPolicies in the namespaces associated with the selected project.

In certain environments, it is important to identify the account that creates these policies in order to protect them from unauthorized modifications or deletions.

Resolution

Enabling Project Network Isolation triggers Rancher to use the  cattle service account in the cattle-system namespace of the downstream cluster to create the default network policies.

This service account is the intended and authorized identity for managing these policies as part of Rancher’s automation. Here's the Audit Log snippet that confirms this behavior:

{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"6d498884-6988-4a59-a95b-f7ed3f0f5708","stage":"ResponseComplete","requestURI":"/apis/networking.k8s.io/v1/namespaces/default/networkpolicies","verb":"create","user":{"username":"system:serviceaccount:cattle-system:cattle","uid":"4247a382-3c38-4fc2-8290-f1f386a4a4cd","groups":["system:serviceaccounts","system:serviceaccounts:cattle-system","system:authenticated"]},"sourceIPs":["10.42.83.203"],"userAgent":"rancher/v0.0.0 (linux/amd64) kubernetes/$Format cluster c-m-vqh6d95x","objectRef":{"resource":"networkpolicies","namespace":"default","name":"hn-nodes","apiGroup":"networking.k8s.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":201},"requestObject":{"kind":"NetworkPolicy","apiVersion":"networking.k8s.io/v1","metadata":{"name":"hn-nodes","namespace":"default","creationTimestamp":null,"labels":{"cattle.io/creator":"norman"},"ownerReferences":[{"apiVersion":"v1","kind":"Namespace","name":"default","uid":"fe1d31ad-78fc-405d-9aa3-cb4d055a260a"}]},"spec":{"podSelector":{},"ingress":[{"from":[{"ipBlock":{"cidr":"10.42.123.192/32"}},{"ipBlock":{"cidr":"10.42.83.192/32"}}]}],"policyTypes":["Ingress"]}},"responseObject":{"kind":"NetworkPolicy","apiVersion":"networking.k8s.io/v1","metadata":{"name":"hn-nodes","namespace":"default","uid":"d752f7a8-d632-4113-be09-9659eb14260d","resourceVersion":"9806","generation":1,"creationTimestamp":"2025-08-01T09:16:37Z","labels":{"cattle.io/creator":"norman"},"ownerReferences":[{"apiVersion":"v1","kind":"Namespace","name":"default","uid":"fe1d31ad-78fc-405d-9aa3-cb4d055a260a"}],"managedFields":[{"manager":"rancher","operation":"Update","apiVersion":"networking.k8s.io/v1","time":"2025-08-01T09:16:37Z","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:cattle.io/creator":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"fe1d31ad-78fc-405d-9aa3-cb4d055a260a\"}":{}}},"f:spec":{"f:ingress":{},"f:policyTypes":{}}}}]},"spec":{"podSelector":{},"ingress":[{"from":[{"ipBlock":{"cidr":"10.42.123.192/32"}},{"ipBlock":{"cidr":"10.42.83.192/32"}}]}],"policyTypes":["Ingress"]}},"requestReceivedTimestamp":"2025-08-01T09:16:37.597644Z","stageTimestamp":"2025-08-01T09:16:37.602050Z","annotations":{"authentication.k8s.io/legacy-token":"system:serviceaccount:cattle-system:cattle","authentication.k8s.io/legacy-token-manual-secret":"cattle-token-fkv4v","authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"cattle-admin-binding\" of ClusterRole \"cattle-admin\" to ServiceAccount \"cattle/cattle-system\""}}

As per the log entry, Rancher automatically created a network policy called hn-nodes in the default namespace. It used its internal service account (cattle) to do this.

Additional Information

The cattle service account is bound to a ClusterRole - named cattle-admin  that grants broad permissions across the downstream cluster.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: >
[....]
rules:
  - apiGroups:
      - '*'
    resources:
      - '*'
    verbs:
      - '*'
  - nonResourceURLs:
      - '*'
    verbs:
      - '*'

The role is intentionally broad to allow the Rancher Cluster Agent to perform a variety of management actions, not limited to network policies.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.