Create administrative boundaries between resources using namespaces

BajaNivel 1Revisión manualeks

Descripción

Namespaces create administrative boundaries in EKS by dividing a cluster into logical partitions for teams, applications, or tenants. They are a core building block for soft multi-tenancy, and several controls used to separate workloads, including quotas, network policies, and service accounts, are scoped to the namespace. The benchmark marks this recommendation Manual.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Verify that namespaces are present and are being used as intentional administrative boundaries for teams, applications, or environments in the EKS cluster. Namespaces are the core logical partition for soft multi-tenancy, and they should be paired with scoped access controls and namespace-level governance such as quotas, limits, and network policies. A namespace should be considered adequately administered only when it has a clear workload or team purpose, appropriately scoped access, and the namespace-level controls required for that use case.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Create separate namespaces for teams, applications, or environments that require their own administrative scope, and move workloads out of the default namespace into that managed namespace structure. Make the namespace boundary meaningful by scoping access to the intended namespaces, applying namespace-level governance such as quotas, limits, service accounts, and network policies, and reducing cluster-wide permissions that bypass the intended separation model. When stronger isolation is required for mutually untrusted workloads, use separate clusters rather than relying on namespaces alone. 1. Create dedicated namespaces for each team, application, or environment that needs its own administrative boundary. 2. Move user workloads out of the default namespace and into the appropriate managed namespaces. 3.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: ekspolicies
Referencia: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.5.1 Create administrative boundaries between resources using namespaces