Kubernetes Rules decide, call by call, what a session opened through Monopam may do on a cluster. They are set per cluster in a Resource Access Policy.
|
Applies to |
Who can do this |
|---|---|
|
Monopam v2026.10 |
Administrators with permission to manage policies. |
Where the rules are
Open the Resource Access Policy that gives access to the cluster, edit the cluster's row and open Kubernetes Rules. The tab appears for Kubernetes resources.
What a rule matches
|
Field |
Meaning |
|---|---|
|
Verb |
get, list, watch, create, update, patch, delete, exec, portforward and others. |
|
API group |
The API group, for example |
|
Resource |
pods, deployments, secrets, and so on. A rule for |
|
Namespace, Resource name |
Limit the rule to namespaces or named objects. |
|
Effect |
Allow, Deny or Approval. An unmatched default applies when no rule matches. |
Approval has no interactive approval for Kubernetes: the call is refused with a message saying it requires approval. Use it to mark calls that must go through another process.
Every decision is written to the audit log as Kubernetes API Call. Commands typed inside kubectl exec are recorded, not filtered; the rules decide whether exec is allowed at all.
Related
-
kubectl and oc through the gateway
-
Resource Access Policy
-
Audit log