Use namespaces to separate workload administration and resource governance

MittelStufe 1Manuelle Prüfunggke

Beschreibung

Use dedicated namespaces to separate GKE Standard workloads by application, team, environment, or tenant. Namespaces provide a logical boundary for organizing resources and applying namespace level governance, but they should be paired with access, quota, network, and pod security controls. The benchmark marks this recommendation Manual.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Run the following command and review the namespaces created in the cluster: kubectl get namespaces --show-labels Verify that user workloads are placed in dedicated namespaces based on application, environment, or tenant, rather than being deployed into the default namespace. In addition, confirm that each workload namespace has both ownership and appropriate namespace level controls, such as RBAC RoleBindings, ResourceQuotas, NetworkPolicies, and Pod Security labels where required.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Create dedicated namespaces for GKE workloads based on application, environment, or tenant boundaries. Move production workloads out of the default namespace and apply consistent namespace level governance so administration, access, and resource controls are easier to manage. • Create a dedicated namespace before deploying new application resources. • Move production workloads out of the default namespace where applicable. • Apply namespace labels for owner, application, environment, tenant, and cost allocation. • Configure least privilege RBAC using namespace level Roles and RoleBindings where possible. • Apply ResourceQuotas, NetworkPolicies, and Pod Security labels based on workload risk and governance requirements. Review namespaces, owners, workload placement, and access bindings to confirm that the namespace model still matches current application and environment boundaries.

Eigenschaften

Betriebssysteme: Beliebig
Tags: gkepolicies
Referenz: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.6.1 Use namespaces to separate workload administration and resource governance