[Yandex Cloud documentation](../../../index.md) > [Yandex Security Deck](../../index.md) > [Step-by-step guides](../index.md) > [Kubernetes® Security Posture Management (KSPM)](index.md) > Managing exceptions to control rules

# Managing exceptions from KSPM security control rules

You can use the KSPM module's exceptions to specify objects you want excluded from the [control rules](../../concepts/kspm.md) in place: all Kubernetes resources within the workspace or specific objects.

## Viewing the list of exceptions from the rules {#view-exceptions-list}

To view the list of exceptions from the Kubernetes security control rules applicable to the [workspace](../../concepts/workspace.md):

{% list tabs group=instructions %}

- Security Deck UI {#cloud-sd}

  1. Go to [Yandex Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select ![file-text](../../../_assets/console-icons/file-text.svg) **Rules and exceptions**.
  1. At the top of the window, select the [workspace](../../concepts/workspace.md) for which you want to view the info on control rule exceptions.
  1. On the **Security control rules** page that opens, go to the **Exceptions** tab.

      The list of exceptions for the Kubernetes rules is provided under **Kubernetes® Security Posture Management** and contains the following fields:
      * **Status**: Active or inactive.
      * **Rules**: List of rules subject to exception.
      * **Resources**: List of resources.
      * **Objects**: List of objects.
      * **Reason for exclusion**: Reason for exception.
      * **Author**: User who created the exception, along with the date and time of its creation.

{% endlist %}

## Creating an exception {#create-exception}

To create a new exception for the Kubernetes control rules:

{% list tabs group=instructions %}

- Security Deck UI {#cloud-sd}

  1. Go to [Yandex Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select ![file-text](../../../_assets/console-icons/file-text.svg) **Rules and exceptions**.
  1. At the top of the window, select the [workspace](../../concepts/workspace.md) in which you want to create an exception from the control rules.
  1. On the **Security control rules** page that opens, go to the **Exceptions** tab.
  1. In the top-right corner, click **Create exception** ![chevron-down](../../../_assets/console-icons/chevron-down.svg) and select `Kubernetes® Security Posture Management`. On the page that opens:
      1. Under **Rules**, select the Kubernetes control rules the selected resources should not be checked against:

          * `All rules`: To exclude the selected resources from the check for compliance with all the Kubernetes control rules.
          * `Selected rules`: To exclude the selected resources from the check for compliance with a given set of rules. To select rules that the new exception will disable compliance checks for:

              * Click ![circle-plus](../../../_assets/console-icons/circle-plus.svg) **Select rules**.
              * In the window that opens, select the rules you want to exclude from compliance checks. If required, use the filter or search at the top of the window.
              * Click **Save selection**.
      1. Under **Scope**, specify the resources you want to exclude when checking the Kubernetes control rules:

          * `All workspace resources`: To exclude all resources controlled in the [workspace](../../concepts/workspace.md).
          * `Resources selected`: To exclude only some resources. To select resources excluded from the check:

              * Click ![circle-plus](../../../_assets/console-icons/circle-plus.svg) **Select resources**.
              * In the window that opens, select the resources to exclude from the rule and click **Apply**.
      1. Optionally, under **Objects (optional)**, specify objects for the exception to cover. You can specify multiple values separated by a comma, space, or `Enter`. To set a value for a parameter or its part, use `*` in names and labels.

          * Check **Namespaces** and enter the namespace name. The naming requirements are as follows:

            * It may be up to 63 characters long.
            * It can only include lowercase Latin letters, numbers, hyphens, and the wildcard symbol (`*`).

          * Check **Workload names** and enter the workload name. The naming requirements are as follows:

            * It may be up to 63 characters long.
            * It can only include lowercase Latin letters, numbers, hyphens, and the wildcard symbol (`*`).
            * The first and last characters must be a letter, number, or `*`.

          * Check **Workload types** and enter the workload type. It can be `Deployment`, `StatefulSet`, `DaemonSet`, `Job`, `CronJob`, `ReplicaSet`, or `Pod`. Format requirements:

            * It may be up to 63 characters long.
            * It may only include Latin letters and numbers.

          * Check **Pod labels** and enter the pod label. Format requirements:

            * The label must be in `key=value` format.
            * The key and value must be no longer than 63 characters each.
            * The key and value can include Latin letters, numbers, hyphens, underscores, and dots.
            * The key may include a forward slash.
            * The value may include `*`.
            * The first and last characters must be a letter or number. 

      1. Under **Reason for exclusion**, give in any format the reason why you are creating an exception.
      1. Select ![image](../../../_assets/console-icons/toggle-on.svg) **Activate exception**.
      1. Click **Create exception**.

{% endlist %}

The new exception will now be displayed under **Kubernetes® Security Posture Management** on the **Exceptions** tab of the **Security control rules** page.

You can also create an exception on the alert page. For more information, see [Creating an alert exception](../alerts/work.md#create-exception).

## Deleting an exception {#delete-exception}

To delete an exception for the Kubernetes control rules:

{% list tabs group=instructions %}

- Security Deck UI {#cloud-sd}

  1. Go to [Yandex Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select ![file-text](../../../_assets/console-icons/file-text.svg) **Rules and exceptions**.
  1. At the top of the window, select the [workspace](../../concepts/workspace.md) in which you want to delete an exception from the control rules.
  1. On the **Security control rules** page that opens, go to the **Exceptions** tab.
  1. Under **Kubernetes® Security Posture Management**, in the row with the exception you want to delete, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete**.

{% endlist %}

This will remove the exception from the [workspace](../../concepts/workspace.md) and cancel the restrictions it imposed on rule checks.