Create administrative boundaries between resources using namespaces

BajaNivel 1Revisión manualaks

Descripción

Create administrative boundaries between resources by organizing AKS workloads into separate namespaces and scoping access to those namespaces with Kubernetes RBAC or Azure RBAC for Kubernetes Authorization. Namespaces form the logical isolation boundary for workloads and resources, and Kubernetes RBAC can scope permissions to a single namespace or across the entire cluster. The benchmark marks this recommendation Manual.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Verify that namespaces are not only present, but are being used as intentional administrative boundaries for teams, applications, or environments within the AKS cluster. Namespaces are the logical isolation boundary for workloads and resources in a shared cluster, and they should be paired with scoped access controls and other namespace-level governance such as quotas and network policies. Namespaces alone are not sufficient for hostile multitenancy, so the audit should focus on whether they are being used consistently to separate administration and operations as intended.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Microsoft recommends namespaces as the logical isolation boundary for workloads and resources in shared clusters, combined with namespace-level governance such as quotas and network policies; where stronger tenant isolation is required, Microsoft recommends separate clusters rather than relying on namespaces alone. 1. Create separate namespaces for each team, application, or environment that requires its own administrative scope. 2. Move workloads out of the default namespace and into the appropriate managed namespace structure. 3. Rebind access using namespace-scoped Role and RoleBinding objects, or namespace-scoped Azure RBAC assignments where applicable. 4. Apply namespace-level controls such as resource quotas and network policies to reinforce the administrative boundary. 5. Remove unused namespaces and reduce cluster-wide permissions that bypass intended namespace separation.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: akspolicies
Referencia: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.6.1 Create administrative boundaries between resources using namespaces