Security ScanningSecurity Exceptions

Security Exceptions

Manage security exceptions and exemptions for compliance checks that don’t apply to your environment.

Security Exceptions Overview
Security Exceptions management interface

Overview

Security Exceptions allow you to document and track intentional deviations from security compliance checks. When a compliance check fails but is acceptable for your use case, you can create an exception to acknowledge and track it.

Scoped per cluster: Exceptions are managed per cluster. Use the cluster selector at the top of the page to choose a specific cluster, or select All clusters for an aggregated view. The page header also shows status counters for Active, Expired, and Revoked exceptions.

Exception Status Types

StatusDescription
ActiveCurrently valid exceptions
ExpiredExceptions that have passed their expiration date
RevokedExceptions that were manually revoked

How to Use

There are two ways to create an exception — both are valid:

Option 1: From the Security Exceptions page

  1. Navigate to Security > Security Scanning > Security Exceptions
  2. Click the + Create Exception button
  3. Fill in the exception details:
    • Select the check to exempt
    • Provide justification
    • Set an expiration date (optional)
  4. Submit the exception

Option 2: From a failed check on the Misconfigurations page

You can also create exceptions directly from a failed compliance check:

  1. Go to Security > Security Scanning > Misconfigurations
  2. Find the failed check you want to exempt
  3. Create an exception for that specific check

Managing Exceptions

  • Search - Use the search bar to find exceptions by resource, namespace, or check ID
  • Filter by Status - Filter by exception status: All, Active, Expired, or Revoked
  • Filter by Check Type - Filter by the type of check the exception applies to: Compliance, Misconfiguration, or Gatekeeper

Best Practices

  1. Document Justification - Always provide clear reasons for exceptions
  2. Set Expiration Dates - Don’t let exceptions live forever
  3. Regular Review - Periodically review active exceptions
  4. Minimize Exceptions - Only create exceptions when truly necessary
  5. Track Expired - Follow up on expired exceptions

Use Cases

ScenarioExample
Legacy ApplicationsApp requires elevated privileges temporarily
Testing EnvironmentsDev/staging with relaxed security
Third-party RequirementsVendor software with specific needs
Planned RemediationKnown issue with fix in progress

Next Steps

MisconfigurationsSecrets Scanning