Which Service Account Creates Default Network Policies When Project Network Isolation Is Enabled in Rancher?

SUSE Rancher 2.x

When Project Network Isolation is enabled in Rancher, the system automatically creates a set of default Kubernetes NetworkPolicies in the namespaces associated with the selected project.

In certain environments, it is important to identify the account that creates these policies in order to protect them from unauthorized modifications or deletions.

Enabling Project Network Isolation triggers Rancher to use the cattle service account in the cattle-system namespace of the downstream cluster to create the default network policies.

This service account is the intended and authorized identity for managing these policies as part of Rancher’s automation. Here's the Audit Log snippet that confirms this behavior:

{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"6d498884-6988-4a59-a95b-f7ed3f0f5708","stage":"ResponseComplete","requestURI":"/apis/networking.k8s.io/v1/namespaces/default/networkpolicies","verb":"create","user":{"username":"system:serviceaccount:cattle-system:cattle","uid":"4247a382-3c38-4fc2-8290-f1f386a4a4cd","groups":["system:serviceaccounts","system:serviceaccounts:cattle-system","system:authenticated"]},"sourceIPs":["10.42.83.203"],"userAgent":"rancher/v0.0.0 (linux/amd64) kubernetes/$Format cluster c-m-vqh6d95x","objectRef":{"resource":"networkpolicies","namespace":"default","name":"hn-nodes","apiGroup":"networking.k8s.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":201},"requestObject":{"kind":"NetworkPolicy","apiVersion":"networking.k8s.io/v1","metadata":{"name":"hn-nodes","namespace":"default","creationTimestamp":null,"labels":{"cattle.io/creator":"norman"},"ownerReferences":[{"apiVersion":"v1","kind":"Namespace","name":"default","uid":"fe1d31ad-78fc-405d-9aa3-cb4d055a260a"}]},"spec":{"podSelector":{},"ingress":[{"from":[{"ipBlock":{"cidr":"10.42.123.192/32"}},{"ipBlock":{"cidr":"10.42.83.192/32"}}]}],"policyTypes":["Ingress"]}},"responseObject":{"kind":"NetworkPolicy","apiVersion":"networking.k8s.io/v1","metadata":{"name":"hn-nodes","namespace":"default","uid":"d752f7a8-d632-4113-be09-9659eb14260d","resourceVersion":"9806","generation":1,"creationTimestamp":"2025-08-01T09:16:37Z","labels":{"cattle.io/creator":"norman"},"ownerReferences":[{"apiVersion":"v1","kind":"Namespace","name":"default","uid":"fe1d31ad-78fc-405d-9aa3-cb4d055a260a"}],"managedFields":[{"manager":"rancher","operation":"Update","apiVersion":"networking.k8s.io/v1","time":"2025-08-01T09:16:37Z","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:cattle.io/creator":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"fe1d31ad-78fc-405d-9aa3-cb4d055a260a\"}":{}}},"f:spec":{"f:ingress":{},"f:policyTypes":{}}}}]},"spec":{"podSelector":{},"ingress":[{"from":[{"ipBlock":{"cidr":"10.42.123.192/32"}},{"ipBlock":{"cidr":"10.42.83.192/32"}}]}],"policyTypes":["Ingress"]}},"requestReceivedTimestamp":"2025-08-01T09:16:37.597644Z","stageTimestamp":"2025-08-01T09:16:37.602050Z","annotations":{"authentication.k8s.io/legacy-token":"system:serviceaccount:cattle-system:cattle","authentication.k8s.io/legacy-token-manual-secret":"cattle-token-fkv4v","authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"cattle-admin-binding\" of ClusterRole \"cattle-admin\" to ServiceAccount \"cattle/cattle-system\""}}

As per the log entry, Rancher automatically created a network policy called hn-nodes in the default namespace. It used its internal service account (cattle) to do this.

The cattle service account is bound to a ClusterRole - named cattle-admin that grants broad permissions across the downstream cluster.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: >
[....]
rules:
  - apiGroups:
      - '*'
    resources:
      - '*'
    verbs:
      - '*'
  - nonResourceURLs:
      - '*'
    verbs:
      - '*'

The role is intentionally broad to allow the Rancher Cluster Agent to perform a variety of management actions, not limited to network policies.