Pod Isolation Actions

Overview

Pod isolation actions let you respond to a threat directly from RAD Security — without leaving the platform and without kubectl access to the cluster. When you create an action, RAD Security queues it for the cluster, and the rad-sync plugin already running in that cluster picks it up and applies the change through the Kubernetes API.

Three action types are available:

Actions are available both from the Actions tab of a cluster in the UI and from the Cluster Actions API. Every action — whichever way it was created — is recorded with its author, timestamps, and execution result.

Prerequisites

- apiGroups: [ "" ]
  resources: [ "pods", "pods/log" ]
  verbs: [ "get", "list", "delete", "update", "patch" ]
- apiGroups: [ "networking.k8s.io" ]
  resources: [ "networkpolicies" ]
  verbs: [ "create", "update", "get" ]

How execution works

Action statuses

Using the UI

Open Data Sources → Connections → Clusters, select the cluster, and open the Actions tab.

The tab lists every isolation action for the cluster, newest first, with its type, target pod and namespace, applied parameters, status, result message, timestamps, and the user who created it. While an action is pending, the list refreshes automatically every few seconds.

Creating an action

Open the dialog

Select New Action in the top right of the Actions tab.

Choose the action type

Pick Terminate Pod, Disable Outbound Traffic, or Label Pod. A short description of the selected action appears under the field.

Select the namespace

Namespaces are loaded from the cluster inventory and can be filtered by typing.

Select the pod

The pod list is scoped to the namespace you selected. Changing the namespace resets the pod selection.

Fill in action-specific fields and confirm

For Label Pod, add one or more key/value pairs. Then confirm with the action button — Terminate Pod, Disable Outbound, or Apply Labels.

The new action appears in the list as Pending and updates to Executed or Failed on its own once rad-sync has processed it.

Terminate Pod

Deletes the pod from the cluster.

Disable Outbound Traffic

Quarantines the pod so it can no longer initiate outbound connections. A single request expands into two actions:

1. A label_pod action that applies the quarantine labels to the target pod:

   rad.security/quarantined: "true"
   rad.security/quarantine_id: "<generated id>"
   

2. A disable_outbound action that creates a deny-all-egress NetworkPolicy named deny-egress-<quarantine_id> in the pod's namespace, selecting exactly those labels:

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: deny-egress-<quarantine_id>
     namespace: <target namespace>
     annotations:
       rad.security/created-by: rad-cluster-action
   spec:
     podSelector:
       matchLabels:
         rad.security/quarantined: "true"
         rad.security/quarantine_id: "<quarantine_id>"
     policyTypes:
       - Egress
     egress: []
   

Because the policy selects a unique quarantine_id, each quarantine is independent — quarantining a second pod in the same namespace does not widen or replace the first policy.

Label Pod

Merge-patches metadata.labels on the target pod. Existing labels that you do not name are left untouched.

Labels are useful to mark a pod for follow-up tooling — for example to make it selectable by your own NetworkPolicies, admission controls, or dashboards:

rad.security/quarantined: "true"
rad.security/reason: "suspicious-activity"

Keys and values must satisfy Kubernetes label syntax; invalid labels are rejected before the action is queued. See Label validation rules.

Removing a quarantine

There is no "undo" action. To lift a quarantine, remove the objects in the cluster directly:

# Remove the deny-all-egress policy
kubectl delete networkpolicy deny-egress-<quarantine_id> -n <namespace>

# Remove the quarantine labels from the pod
kubectl label pod <pod> -n <namespace> \
  rad.security/quarantined- rad.security/quarantine_id-

The quarantine_id is shown on the action entry in the Actions tab and returned in the action's parameters.

API reference

All endpoints are served from https://api.rad.security.

Authentication

Create an access key in Settings → Access Keys, exchange it for a session token, and send the token as a bearer token. See Managing API Keys.

TOKEN=$(curl -s 'https://api.rad.security/authentication/authenticate' \
  -d '{"access_key_id":"<key id>","secret_key":"<secret key>"}' | jq -r .token)

Create actions

POST /accounts/{account_id}/clusters/{cluster_id}/actions

The request body is an array, so several actions can be queued in one call. Returns 201 Created with the created actions.

curl -X POST \
  "https://api.rad.security/accounts/$ACCOUNT_ID/clusters/$CLUSTER_ID/actions" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '[
        {
          "action_type": "terminate_pod",
          "target_pod_name": "nginx-new",
          "target_namespace": "default"
        }
      ]'

curl -X POST \
  "https://api.rad.security/accounts/$ACCOUNT_ID/clusters/$CLUSTER_ID/actions" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '[
        {
          "action_type": "disable_outbound",
          "target_pod_name": "nginx-new",
          "target_namespace": "default"
        }
      ]'

curl -X POST \
  "https://api.rad.security/accounts/$ACCOUNT_ID/clusters/$CLUSTER_ID/actions" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '[
        {
          "action_type": "label_pod",
          "target_pod_name": "nginx-new",
          "target_namespace": "default",
          "parameters": {
            "labels": {
              "rad.security/quarantined": "true",
              "rad.security/reason": "suspicious-activity"
            }
          }
        }
      ]'

curl -X POST \
  "https://api.rad.security/accounts/$ACCOUNT_ID/clusters/$CLUSTER_ID/actions" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '[
        {
          "action_type": "label_pod",
          "target_pod_name": "api-7d9f",
          "target_namespace": "payments",
          "parameters": { "labels": { "rad.security/reason": "triage" } }
        },
        {
          "action_type": "disable_outbound",
          "target_pod_name": "api-7d9f",
          "target_namespace": "payments"
        }
      ]'

Request fields

Response

[
  {
    "id": "ca-2rF9xQ8mS1kLp7vTn3JcYwZ0aBd",
    "cluster_id": "927dff9c-6ed3-412b-b39a-b4f077164398",
    "account_id": "2IAtTppYqpVGxSdkBWW5n7zYzVU",
    "action_type": "terminate_pod",
    "status": "Pending",
    "target_pod_name": "nginx-new",
    "target_namespace": "default",
    "parameters": {},
    "created_by": "b1f1c6d2-8f5a-4a0e-9d3e-1c2f4a6b8d0e",
    "created_at": "2026-07-31T15:12:15.482Z",
    "updated_at": "2026-07-31T15:12:15.482Z"
  }
]

List actions

GET /accounts/{account_id}/clusters/{cluster_id}/actions

Returns every action for the cluster, newest first.

curl "https://api.rad.security/accounts/$ACCOUNT_ID/clusters/$CLUSTER_ID/actions" \
  -H "Authorization: Bearer $TOKEN" | jq .

{
  "entries": [
    {
      "id": "ca-2rF9xQ8mS1kLp7vTn3JcYwZ0aBd",
      "cluster_id": "927dff9c-6ed3-412b-b39a-b4f077164398",
      "account_id": "2IAtTppYqpVGxSdkBWW5n7zYzVU",
      "action_type": "terminate_pod",
      "status": "Executed",
      "target_pod_name": "nginx-new",
      "target_namespace": "default",
      "parameters": {},
      "result": "Resource default/nginx-new has been deleted",
      "created_by": "b1f1c6d2-8f5a-4a0e-9d3e-1c2f4a6b8d0e",
      "created_at": "2026-07-31T15:12:15.482Z",
      "updated_at": "2026-07-31T15:12:17.913Z"
    }
  ],
  "page_count": 1,
  "total_count": 1,
  "page": 1,
  "page_size": 1
}

Get an action

GET /accounts/{account_id}/clusters/{cluster_id}/actions/{action_id}

Use this to poll a single action until it leaves Pending.

curl "https://api.rad.security/accounts/$ACCOUNT_ID/clusters/$CLUSTER_ID/actions/$ACTION_ID" \
  -H "Authorization: Bearer $TOKEN" | jq '.status, .result'

Action object

Validation rules

Requests are validated before anything is queued. A rejected request returns 400 and creates no actions — including the other entries in the same batch.

Label validation rules

Troubleshooting

Next Steps