Create administrative boundaries between resources using namespaces

RendahLevel 1Tinjauan manualeks

Deskripsi

Namespaces create administrative boundaries in EKS by dividing a cluster into logical partitions for teams, applications, or tenants. They are a core building block for soft multi-tenancy, and several controls used to separate workloads, including quotas, network policies, and service accounts, are scoped to the namespace. The benchmark marks this recommendation Manual.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Verify that namespaces are present and are being used as intentional administrative boundaries for teams, applications, or environments in the EKS cluster. Namespaces are the core logical partition for soft multi-tenancy, and they should be paired with scoped access controls and namespace-level governance such as quotas, limits, and network policies. A namespace should be considered adequately administered only when it has a clear workload or team purpose, appropriately scoped access, and the namespace-level controls required for that use case.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Create separate namespaces for teams, applications, or environments that require their own administrative scope, and move workloads out of the default namespace into that managed namespace structure. Make the namespace boundary meaningful by scoping access to the intended namespaces, applying namespace-level governance such as quotas, limits, service accounts, and network policies, and reducing cluster-wide permissions that bypass the intended separation model. When stronger isolation is required for mutually untrusted workloads, use separate clusters rather than relying on namespaces alone. 1. Create dedicated namespaces for each team, application, or environment that needs its own administrative boundary. 2. Move user workloads out of the default namespace and into the appropriate managed namespaces. 3.

Properti

Sistem operasi: Apa saja
Tag: ekspolicies
Referensi: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.5.1 Create administrative boundaries between resources using namespaces