Use namespaces to separate workload administration and resource governance

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Run the following command and review the namespaces created in the cluster: kubectl get namespaces --show-labels Verify that user workloads are placed in dedicated namespaces based on application, environment, or tenant, rather than being deployed into the default namespace. In addition, confirm that each workload namespace has both ownership and appropriate namespace level controls, such as RBAC RoleBindings, ResourceQuotas, NetworkPolicies, and Pod Security labels where required.

How it is fixed

Fix method: Guidance or infrastructure patch

Create dedicated namespaces for GKE workloads based on application, environment, or tenant boundaries. Move production workloads out of the default namespace and apply consistent namespace level governance so administration, access, and resource controls are easier to manage. • Create a dedicated namespace before deploying new application resources. • Move production workloads out of the default namespace where applicable. • Apply namespace labels for owner, application, environment, tenant, and cost allocation. • Configure least privilege RBAC using namespace level Roles and RoleBindings where possible. • Apply ResourceQuotas, NetworkPolicies, and Pod Security labels based on workload risk and governance requirements. Review namespaces, owners, workload placement, and access bindings to confirm that the namespace model still matches current application and environment boundaries.