Policy Exceptions Management

Policy Exceptions are temporary deviations that are required when following policy practices might not be possible because they can hinder operational needs.

Policy Exception workflow

Every policy exception request is sent to an admin for review. The admin can either accept or reject the request. If the request gets accepted, the PolicyException resource gets deployed and the user who requested the exception gets notified via email.

Configuring Policy Exception Settings

A Nirmata Admin User can manage the approval and review settings of Policy Exception Requests as per requirements.

To manage the Policy Exception settings:

1. Go to Settings -> Policy Exceptions.
2. Manage the approval of Policy Exception Requests by checking the boxes beside the available options.
   a. Checking the Require Two Factor Authentication (2FA) to approve a request option will require setting up two-factor authentication and compel users to complete the two-factor authentication to approve an exception request.
   b. Checking the Automatically approve requests by Administrators option will automatically approve policy exception requests that are raised by administrators without going through the approval process.
   c. Checking the Revoke all approvals if the requestor changes the resources or policies for the exception option will revoke any previous approvals given to an exception request if the user changes any of the target selectors like cluster, violations, or namespaces for the request.
   
3. Select the intital reviewers for the Policy Exception Requests under the Reviewers and required approvals section by choosing any of the available options.
   a. Choosing the Any Administrator or Platform user option will allow any Admin or Platform user to review the raised exception request.
   b. Choosing the Selected Administrators option will allow only the selected Admin users for the review of the requests. Multiple Admin users can be selected from the available dropdown. An Admin user can also add or remove reviewers on specific requests.
   
4. Define the number of reviewers required to approve a Policy Exception Request for the exception to be granted by writing the number in the given text box.
5. Click on the Save button to save the changes.

Requesting a Policy Exception

Policy Exception Request can be raised directly from the Policy Exceptions page or from the Policy Reports page of a particular namespace of a cluster.

Note: Existing clusters in NCH need to provide extra permissions for Policy Exception expiry feature to work. The extra permission is for the kverno-cleanup-controller to delete policy exceptions from the cluster. Check out the nirmata:policyexception-manager ClusterRoleBinding in Nirmata Kube Controller to see the changes.

To raise a Policy Exception Request:

1. Go to Policy -> Policy Exceptions. The page displays the already created Policy Exception Requests that are either approved, denied, or requires approval.
2. Click on the Request Policy Exception button located on the right hand top corner of the screen. Fill out the Policy Exception Request form with all the details.
3. Give a brief description on why the exception is required.
4. Select the start date for the exception request to be applied according to the needs or opt for the option Immediately after approval to apply the exception immediately after approval from the reviewers.
5. Select the time duration for the policy excetion. The available options are 1 day, 1 week, 1 month, or Never Expires.

NOTE: Exceptions should be short-lived. Thus, it is not recommended to use Never Expires.

6. Exceptions can be applied for cluster resources and/or repository files. a. If exceptions should be applied to cluster resources, select all the namespaces and clusters that require the exception. b. If exceptions should be applied to files in the Git repository, select all the repositories and branches that require the exception.
7. Select the violations for which the policy exception will be applied.
   a. If the policy exception is to be applied to all the available policy violations in the selected namespaces and repositories, select the All Violations option.
   

8. Click on the Request Exception button to raise the Policy Exception Request. It will send an alert to the admin for a review.

Note: The Policy Exception Request can be raised in the same way through the Policy Reports page. For that, go to the Policy Reports page and view the available namespaces. Click on any of the namespaces that will require a Policy Exception, and raise a Policy exception request by clicking on the Request Policy Exception button.

Reviewing a Policy Exception Request

To review the Policy Exception Requests:

1. Go to Policy -> Policy Exceptions. The page displays the list of already created Policy Excepttion Requests.
2. Click on the Policy Exception Request name to view the created Policy Exception Request in detail. The page will also contain information on the activity of the reviewer under the Reviews and Edits section located at the right hand side of the screen.

Viewing Policy Exceptions

If a Policy Exception Request is approved, NCH deploys the corresponding PolicyException resource to the target environments. These can be viewed under Policy Exceptions -> Deployed Policy Exceptions tab along with their deployment status and expiry details.