Resources should be created in a non-default namespace in Kubernetes

kubernetes

Classification:

compliance

Framework:

cis-kubernetes

Control:

5.7.4

Set up the kubernetes integration.

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes application of RBAC and other controls more difficult.

Rationale

Resources in a Kubernetes cluster should be segregated by namespace, to allow for security controls to be applied at that level and to make it easier to manage resources.

Audit

Run this command to list objects in default namespace: kubectl get all

The only entries there should be system managed resources such as the Kubernetes service.

Remediation

Ensure that namespaces are created to allow for appropriate segregation of Kubernetes resources and that all new resources are created in a specific namespace.

Impact

None

Default value

Unless a namespace is specific on object creation, the default namespace will be used.

References

None

CIS controls

None