Carbon Black Cloud: Hardening Policy rule exceptions are not working for Tanzu Kubernetes cluster

Products

• Carbon Black Cloud Container

Issue/Introduction

Applying exclusions to the Hardening Policy rules in the Carbon Black Cloud console do not take effect, and can prevent Tanzu upgrades and node refresh actions.

Environment

• Carbon Black Cloud: Container Advanced Version 1.23 and Lower
• Tanzu Kubernetes clusters

Cause

The data collected from Kubernetes clusters when running the `kubectl port-forward' command contains only the pod name and the ports that were used and the same goes for the "Exec to container' rule.

Resolution

Create exceptions to Hardening Policy rules based on the Resource name instead of Label.

Example:  "Resource starts with etcd"