Create administrative boundaries between resources using namespaces

LowLevel 1Manual reviewaks

Description

Create administrative boundaries between resources by organizing AKS workloads into separate namespaces and scoping access to those namespaces with Kubernetes RBAC or Azure RBAC for Kubernetes Authorization. Namespaces form the logical isolation boundary for workloads and resources, and Kubernetes RBAC can scope permissions to a single namespace or across the entire cluster. The benchmark marks this recommendation Manual.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Verify that namespaces are not only present, but are being used as intentional administrative boundaries for teams, applications, or environments within the AKS cluster. Namespaces are the logical isolation boundary for workloads and resources in a shared cluster, and they should be paired with scoped access controls and other namespace-level governance such as quotas and network policies. Namespaces alone are not sufficient for hostile multitenancy, so the audit should focus on whether they are being used consistently to separate administration and operations as intended.

How it is fixed

Fix method: Guidance or infrastructure patch

Microsoft recommends namespaces as the logical isolation boundary for workloads and resources in shared clusters, combined with namespace-level governance such as quotas and network policies; where stronger tenant isolation is required, Microsoft recommends separate clusters rather than relying on namespaces alone. 1. Create separate namespaces for each team, application, or environment that requires its own administrative scope. 2. Move workloads out of the default namespace and into the appropriate managed namespace structure. 3. Rebind access using namespace-scoped Role and RoleBinding objects, or namespace-scoped Azure RBAC assignments where applicable. 4. Apply namespace-level controls such as resource quotas and network policies to reinforce the administrative boundary. 5. Remove unused namespaces and reduce cluster-wide permissions that bypass intended namespace separation.

Properties

Operating systems: Any
Tags: akspolicies
Reference: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.6.1 Create administrative boundaries between resources using namespaces