Network policies should be defined to isolate traffic in cluster network

문서 > Datadog 보안 > OOTB Rules > Network policies should be defined to isolate traffic in cluster network

Classification:

compliance

Framework:

cis-kubernetes

Control:

5.3.2

Set up the kubernetes integration.

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

Use network policies to isolate traffic in your cluster network.

Rationale

Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate only with those they are supposed to. A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. Network Policies are namespace scoped. When a network policy is introduced to a given namespace, all traffic not allowed by the policy is denied. However, if there are no network policies in a namespace, all traffic will be allowed into and out of the pods in that namespace.

Audit

Run the following command and review the NetworkPolicy objects created in the cluster: kubectl --all-namespaces get networkpolicy

Ensure that each namespace defined in the cluster has at least one Network Policy.

Remediation

Follow the documentation and create network policy objects as you need them.

Impact

Once network policies are in use within a given namespace, traffic not explicitly allowed by a network policy will be denied. It is important to ensure that, when introducing network policies, legitimate traffic is not blocked.

Default value

By default, network policies are not created.

References

CIS controls

Version 6.14.1 Implement Network Segmentation Based On Information Class Segment - The network based on the label or classification level of the information stored on the servers. Locate all sensitive information on separated VLANS with firewall filtering to ensure that only authorized individuals are only able to communicate with systems necessary to fulfill their specific responsibilities.

Version 7.14.1 Segment the Network Based on Sensitivity - Segment the network based on the label or classification level of the information stored on the servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).

Version 7.14.2 Enable Firewall Filtering Between VLANs - Enable firewall filtering between VLANs to ensure that only authorized systems are able to communicate with other systems necessary to fulfill their specific responsibilities.