Create Disallowed Namespace

Severity: WARNING
Source: k8saudit

Detect any attempt to create a namespace outside of a set of known namespaces

Telemetry coverage

Platform	Record / event type
Kubernetes	create-namespaces: create namespaces

Rules detecting the same action

These rules filter on the same operation.

Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
K8s Namespace Created (Falco)

Stages and Predicates

Stage 1: `falco_condition`

and
  not
    objectRef.name in ["default", "kube-public", "kube-system"]
  objectRef.resource eq "namespaces"
  stage eq "ResponseComplete"
  verb eq "create"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`objectRef.name`	in	`default`, `kube-public`, `kube-system`	`excludes:objectRef.name` `field:"objectRef.name" value:"default"` `field:"objectRef.name" value:"kube-public"` `field:"objectRef.name" value:"kube-system"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`objectRef.resource`	eq	`namespaces`	`field:"objectRef.resource" kind:eq value:"namespaces"`
`stage`	in	`ResponseComplete`	`field:"stage" kind:in value:"ResponseComplete"`
`verb`	eq	`create`	`field:"verb" kind:eq value:"create"`