Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Managing exceptions from KSPM security control rules

Written by
Updated at July 29, 2026
View in Markdown

You can use the KSPM module's exceptions to specify objects you want excluded from the control rules in place: all Kubernetes resources within the workspace or specific objects.

Viewing the list of exceptions from the rules

To view the list of exceptions from the Kubernetes security control rules applicable to the workspace:

  1. Go to Yandex Security Deck.

  2. In the left-hand panel, select Rules and exceptions.

  3. At the top of the window, select the workspace for which you want to view the info on control rule exceptions.

  4. On the Security control rules page that opens, go to the Exceptions tab.

    The list of exceptions for the Kubernetes rules is provided under Kubernetes® Security Posture Management and contains the following fields:

    • Status: Active or inactive.
    • Rules: List of rules subject to exception.
    • Resources: List of resources.
    • Objects: List of objects.
    • Reason for exclusion: Reason for exception.
    • Author: User who created the exception, along with the date and time of its creation.

Creating an exception

To create a new exception for the Kubernetes control rules:

  1. Go to Yandex Security Deck.

  2. In the left-hand panel, select Rules and exceptions.

  3. At the top of the window, select the workspace in which you want to create an exception from the control rules.

  4. On the Security control rules page that opens, go to the Exceptions tab.

  5. In the top-right corner, click Create exception and select Kubernetes® Security Posture Management. On the page that opens:

    Note

    When creating exceptions for Admission rules, you can additionally manage the operating modes of these rules. For more information, see Managing lock mode with the help of exceptions.

    1. Under Rules, select the Kubernetes control rules the selected resources should not be checked against:

      • All rules: To exclude the selected resources from the check for compliance with all the Kubernetes control rules.

      • Selected rules: To exclude the selected resources from the check for compliance with a given set of rules. To select rules that the new exception will disable compliance checks for:

        • Click Select rules.
        • In the window that opens, select the rules you want to exclude from compliance checks. If required, use the filter or search at the top of the window.
        • Click Save selection.

    2. Under Scope, specify the resources you want to exclude when checking the Kubernetes control rules:

      • All workspace resources: To exclude all resources controlled in the workspace.

      • Resources selected: To exclude only some resources. To select resources excluded from the check:

        • Click Select resources.
        • In the window that opens, select the resources to exclude from the rule and click Apply.

    3. Optionally, under Objects (optional), update the objects subject to the exception. You can specify multiple values separated by a comma, space, or Enter.

      • To exclude multiple objects at once, specify a custom value for the parameter or its part. To do this, use the following wildcard characters in names and labels:

        • *: Replaces 0 or more characters.
        • ?: Replaces one character.

      • Check Namespaces and enter the namespace name. The naming requirements are as follows:

        • It may be up to 63 characters long.
        • It may only contain lowercase Latin letters, numbers, hyphens, and the * and ? wildcard symbols.

      • Check Workload names and enter the workload name. The naming requirements are as follows:

        • It may be up to 63 characters long.
        • It may only contain lowercase Latin letters, numbers, hyphens, and the * and ? wildcard symbols.
        • The first and last characters must be a letter, number, or the * or ? wildcard symbols.

      • Check Workload types and enter the workload type. It can be Deployment, StatefulSet, DaemonSet, Job, CronJob, ReplicaSet, or Pod. Format requirements:

        • It may be up to 63 characters long.
        • It may only include Latin letters and numbers.

      • Check Pod labels and enter the pod label. Format requirements:

        • The label must be in key=value format.
        • The key and value must be no longer than 63 characters each.
        • The key and value can include Latin letters, numbers, hyphens, underscores, and dots.
        • The key may include a forward slash.
        • The value may include the * or ? wildcard symbols.
        • The first and last characters must be a letter or number.

    4. Under Reason for exclusion, give in any format the reason why you are creating an exception.

    5. Select Activate exception.

    6. Click Create exception.

The new exception will now be displayed under Kubernetes® Security Posture Management on the Exceptions tab of the Security control rules page.

You can also create an exception on the alert page. For more information, see Creating an alert exception.

Deleting an exception

To delete an exception for the Kubernetes control rules:

  1. Go to Yandex Security Deck.
  2. In the left-hand panel, select Rules and exceptions.
  3. At the top of the window, select the workspace in which you want to delete an exception from the control rules.
  4. On the Security control rules page that opens, go to the Exceptions tab.
  5. Under Kubernetes® Security Posture Management, in the row with the exception you want to delete, click and select Delete.

This will remove the exception from the workspace and cancel the restrictions it imposed on rule checks.

Previous
Performing security compliance checks
Next
Managing rule modes