diff --git a/cluster/kube/cluster.jsonnet b/cluster/kube/cluster.jsonnet
index 89ffdb0..09c3b33 100644
--- a/cluster/kube/cluster.jsonnet
+++ b/cluster/kube/cluster.jsonnet
@@ -135,6 +135,9 @@
         policies.AllowNamespaceInsecure("kube-system"),
         # TODO(q3k): fix this?
         policies.AllowNamespaceInsecure("ceph-waw2"),
+        policies.AllowNamespaceInsecure("matrix"),
+        policies.AllowNamespaceInsecure("registry"),
+        policies.AllowNamespaceInsecure("internet"),
     ],
 
     // Allow all service accounts (thus all controllers) to create secure pods.