Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Managing the operating modes of security control rules of KSPM

Written by
Updated at July 29, 2026
View in Markdown

The Admission type security control rules of the KSPM module have two operating modes:

  • Audit: Mode in which a rule violation does not block the deployment of workloads in Kubernetes clusters. Default mode.
  • Blocking: Mode in which a rule violation leads to blocking the deployment of workloads in Kubernetes clusters.

Enabling Blocking mode

To enable Blocking mode for a rule:

  1. Go to Yandex Security Deck.
  2. In the left-hand panel, select  Rules and exceptions.
  3. At the top of the window, select the workspace you want to change the rule mode in.
  4. On the Security control rules page that opens, go to the Kubernetes® tab. In the list that appears, find the Admission type rule whose mode you want to change. Optionally, use the filter at the top of the list.
  5. Click Mode: Audit next to the rule and select Enable block mode.
  6. In the window that opens, confirm enabling lock mode.

You can also change the rule's operating mode in the **Rule type
** field on the rule's detailed info page.

Enabling Audit mode

To enable Audit mode for a rule (if Blocking mode was previously enabled for this rule):

  1. Go to Yandex Security Deck.
  2. In the left-hand panel, select  Rules and exceptions.
  3. At the top of the window, select the workspace you want to change the rule mode in.
  4. On the Security control rules page that opens, go to the Kubernetes® tab. In the list that appears, find the Admission type rule whose mode you want to change. Optionally, use the filter at the top of the list.
  5. Click Mode: Blocking next to the rule and select Disable block mode.
  6. In the window that opens, confirm disabling lock mode.

You can also change the rule's operating mode in the **Rule type
** field on the rule's detailed info page.

Managing lock mode with the help of exceptions

When you activate Blocking mode for a rule, by default it applies to all Kubernetes® clusters in the workspace.

To change this logic and explicitly specify which Kubernetes® resources in the workspace will not be subject to Blocking mode, create an exception to the rule:

  1. Go to Yandex Security Deck.

  2. In the left-hand panel, select  Rules and exceptions.

  3. At the top of the window, select the workspace in which you want to set up an exception for the security control rule.

  4. On the Security control rules page that opens, navigate to the Kubernetes® tab and select from the list the Admission type rule you want to create an exception for. Optionally, use the filter at the top of the list.

  5. In the rule info window that opens, go to the Exceptions tab and click Create exception.

  6. Under Effect, select the correct lock mode:

    • Ignore rule: Checks for compliance with the rule for the resources named in the exception are off completely; no violations are logged.
    • Disable lock mode for rule: Violations of the rule for the resources named in the exception will be logged, but deployment of workloads in Kubernetes® clusters will not be blocked.

  7. Under Scope, specify the clusters for which to cancel the lock, configure other settings, and complete the exception setup.

    Tip

    If necessary, look up Managing exceptions from KSPM security control rules.

Security Deck workspaces allow you to manage Yandex Cloud infrastructure security in a more granular way. They are containers for settings and resources of Security Deck modules, lists of controlled resources, control parameters, etc. For more information, see Security Deck workspaces.

You can use KSPM exceptions to specify objects you want excluded from the control rules in place. For more information on exceptions, see Managing exceptions from KSPM security control rules.

Previous
Managing exceptions to control rules
Next
Overview