Nothing detects the pod-security exception drifting from the mutation scope it claims to mirror

🤖 Generated by the Agentic Engineer

Evidence

#2824 exists because two scopes that must agree drifted apart silently:
pod-security-mutations exempted controls cluster-wide, while the Kyverno mutation it names as its
compensating control — add-security-context — excludes twelve namespaces. Nothing detected that,
and nothing would detect it happening again.

The narrowing in #2824 makes the two agree today: the exception's NotIn values are now exactly the
mutation's excluded namespace set (verified set-equal, 12 = 12, when that change landed). But that
agreement is held together by a code comment, and the failure mode is silent in both directions:

a namespace added to the mutation's exclusions but not the exception ⇒ the exception suppresses
controls where nothing injects them (the original security: the cluster-wide pod-security exception suppresses controls where its own compensating control does not run #2824 defect, reintroduced);
a namespace removed from the mutation's exclusions but left in the exception's NotIn ⇒
controls stay enforced where the mutation now runs, producing findings that are not real gaps.

Neither shows up as a failing check. Both read as compliance.

Expected behaviour

A check fails when the exception's NotIn namespace set stops matching the mutation rules'
excluded-namespace set, naming the specific namespaces that differ and which side they are on.

Smallest useful change

A script in scripts/ invoked from CI that reads both files structurally (yq, not grep) and
diffs the two sets. It needs no cluster and no scanner — both inputs are in the tree.

Two details worth pinning, because a naive implementation gets them wrong:

add-security-context carries several rules, and only add-pod-security-context /
add-container-security-context exclude the twelve. add-imageuid-pod-security-context matches
cert-manager, keda and opencost by name and supplies the fields there — so those three are
correctly not in the exception's NotIn. Read the match blocks, not only the exclusions.
The guard must fail closed: an unparseable file, a missing rule, or a NotIn expression that has
moved must be an error, not an empty set compared against an empty set.

Acceptance criteria

CI fails when the two sets diverge, in either direction, naming the differing namespaces.
The guard has a RED proof: a fixture with a namespace added on one side only fails it.
The guard passes on the current tree.
cert-manager/keda/opencost do not trip it.

Rough size: small.

Part of #2824

🔗 Related PRs

#3085 - security(kubescape): except the operator-bundle RBAC the CI scan actually sees [merged]
#3142 - docs(kubescape): correct the controller-rbac migration guidance [merged]
#3212 - docs(kubescape): record the keep decision for the three unfalsifiable controls [merged]
#3210 - security(k8s): disposition vendored KubeVirt and CDI operator RBAC as a class [merged]
#3203 - security(vault-backup): disposition the last two CKV_K8S_40 findings as one deferred exception [merged]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Create Plan

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

🤖 Generated by the Agentic Engineer

Baseline for this issue, measured 2026-08-19 while sizing C-0211 (#3217): the two scopes are
currently in sync, so what is missing is the detection, not a fix.

add-security-context's add-container-security-context exclusions and pod-security-mutations'
namespaceSelector NotIn values are the same twelve namespaces, sorted and compared:

cdi,chaos-mesh,flux-system,kube-node-lease,kube-public,kube-system,kubescape,kubevirt,local-path-storage,longhorn-system,observability,velero

Two notes for whoever builds the detector:

Compare against add-container-security-context, not add-pod-security-context. The two rules
have different exclusion sets — the pod-level rule additionally excludes cert-manager, keda,
opencost and tofu-controller-created pods, which are handled by
add-imageuid-pod-security-context instead. A detector keyed on the pod-level rule would report
drift that is not drift.
pod-security-mutations-unscoped deliberately has no match: block and must not be compared
this way; it is cluster-wide by design while C-0013 (Six flux-system controllers fail C-0013 on a missing runAsGroup, blocking the C-0013 narrowing #3223) and C-0211 (security(kubescape): C-0211's residual population behind the pod-security exception is unsized and unowned #3217) remain unresolved.

chore: agent-claim #3224 nonce=faa6c3d02d82f239fae55726f08fedeb

Navigation Menu

Repository navigation

Nothing detects the pod-security exception drifting from the mutation scope it claims to mirror #3224

Evidence

Expected behaviour

Smallest useful change

Acceptance criteria

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Nothing detects the pod-security exception drifting from the mutation scope it claims to mirror #3224

Description

Evidence

Expected behaviour

Smallest useful change

Acceptance criteria

Activity

coderabbitai commented on Aug 18, 2026

devantler commented on Aug 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions