Use namespaces to separate workload administration and resource governance

MediaNivel 1Revisión manualgke

Descripción

Use dedicated namespaces to separate GKE Standard workloads by application, team, environment, or tenant. Namespaces provide a logical boundary for organizing resources and applying namespace level governance, but they should be paired with access, quota, network, and pod security controls. The benchmark marks this recommendation Manual.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Run the following command and review the namespaces created in the cluster: kubectl get namespaces --show-labels Verify that user workloads are placed in dedicated namespaces based on application, environment, or tenant, rather than being deployed into the default namespace. In addition, confirm that each workload namespace has both ownership and appropriate namespace level controls, such as RBAC RoleBindings, ResourceQuotas, NetworkPolicies, and Pod Security labels where required.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Create dedicated namespaces for GKE workloads based on application, environment, or tenant boundaries. Move production workloads out of the default namespace and apply consistent namespace level governance so administration, access, and resource controls are easier to manage. • Create a dedicated namespace before deploying new application resources. • Move production workloads out of the default namespace where applicable. • Apply namespace labels for owner, application, environment, tenant, and cost allocation. • Configure least privilege RBAC using namespace level Roles and RoleBindings where possible. • Apply ResourceQuotas, NetworkPolicies, and Pod Security labels based on workload risk and governance requirements. Review namespaces, owners, workload placement, and access bindings to confirm that the namespace model still matches current application and environment boundaries.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: gkepolicies
Referencia: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.6.1 Use namespaces to separate workload administration and resource governance