Back to Checks
kubernetes

API server pod has NamespaceLifecycle admission control plugin enabled

apiserver_namespace_lifecycle_plugin
Service: apiserverSeverity: high
OfficialBuilt-inVerified
Categories:cluster-security
Resource Type:Pod

Kubernetes API server has the NamespaceLifecycle admission controller active and not disabled, enforcing namespace lifecycle rules by rejecting objects targeting non-existent or terminating namespaces and protecting system namespaces from deletion.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without NamespaceLifecycle, resources can be created in namespaces being removed or that never existed, causing inconsistent state and controller errors.

This degrades integrity and availability, leaving orphaned objects, delaying cleanup, and potentially preserving access via leftover service accounts or policies.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_namespace_lifecycle_plugin

Recommendation

Ensure NamespaceLifecycle remains enabled to enforce namespace governance. Apply least privilege for namespace creation/deletion, and use separation of duties for approvals. Monitor deletions and remediate stuck finalizers so cleanup completes. Combine with RBAC and audit logs for defense in depth.

Remediation

Other

1SSH to the control plane node.
2Edit the API server manifest: /etc/kubernetes/manifests/kube-apiserver.yaml
3In spec.containers[0].command, ensure NamespaceLifecycle is enabled and not disabled:
4```yaml
5# Critical: enable NamespaceLifecycle plugin
6- --enable-admission-plugins=NamespaceLifecycle
7# If this flag exists with a list, append ,NamespaceLifecycle to it
8# Ensure NamespaceLifecycle is NOT present in:
9# - --disable-admission-plugins=...
10```
11Save the file; the kubelet will restart the API server automatically.
12Verify the setting is present in the running pod spec:
13```
14kubectl -n kube-system get pod -l component=kube-apiserver -o jsonpath='{.items[0].spec.containers[0].command}' | grep NamespaceLifecycle
15```

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_namespace_lifecycle_plugin(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"NamespaceLifecycle admission control plugin is set in pod {pod.name}."
            )

            namespace_lifecycle_plugin_set = False
            for container in pod.containers.values():
                namespace_lifecycle_plugin_set = False
                # Check if "--enable-admission-plugins" includes "NamespaceLifecycle"
                # and "--disable-admission-plugins" does not include "NamespaceLifecycle"
                for command in container.command:
                    if command.startswith("--enable-admission-plugins"):
                        if "NamespaceLifecycle" in (command.split("=")[1]):
                            namespace_lifecycle_plugin_set = True
                    elif command.startswith("--disable-admission-plugins"):
                        if "NamespaceLifecycle" in (command.split("=")[1]):
                            namespace_lifecycle_plugin_set = False
                if not namespace_lifecycle_plugin_set:
                    break

            if not namespace_lifecycle_plugin_set:
                report.status = "FAIL"
                report.status_extended = f"NamespaceLifecycle admission control plugin is not set in pod {pod.name}."

            findings.append(report)
        return findings

References