Check ID: apiserver_namespace_lifecycle_plugin
Provider: Kubernetes
Service: apiserver
Severity: HIGH
Categories: cluster-security
Resource type: Pod

​
What this check verifies

Kubernetes API server has the NamespaceLifecycle admission controller active and not disabled, enforcing namespace lifecycle rules by rejecting objects targeting non-existent or terminating namespaces and protecting system namespaces from deletion.

​
Risk

Without NamespaceLifecycle, resources can be created in namespaces being removed or that never existed, causing inconsistent state and controller errors. This degrades integrity and availability, leaving orphaned objects, delaying cleanup, and potentially preserving access via leftover service accounts or policies.

​
Recommendation

Ensure NamespaceLifecycle remains enabled to enforce namespace governance. Apply least privilege for namespace creation/deletion, and use separation of duties for approvals. Monitor deletions and remediate stuck finalizers so cleanup completes. Combine with RBAC and audit logs for defense in depth.

​
Remediation

Dashboard steps
  1. SSH to the control plane node.
  2. Edit the API server manifest: /etc/kubernetes/manifests/kube-apiserver.yaml
  3. In spec.containers[0].command, ensure NamespaceLifecycle is enabled and not disabled: 
    # Critical: enable NamespaceLifecycle plugin
- --enable-admission-plugins=NamespaceLifecycle
# If this flag exists with a list, append ,NamespaceLifecycle to it
# Ensure NamespaceLifecycle is NOT present in:
# - --disable-admission-plugins=...
  4. Save the file; the kubelet will restart the API server automatically.
  5. Verify the setting is present in the running pod spec: 
    kubectl -n kube-system get pod -l component=kube-apiserver -o jsonpath='{.items[0].spec.containers[0].command}' | grep NamespaceLifecycle

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_namespace_lifecycle_plugin. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks