Use namespaces to separate workload administration and resource governance

SedangLevel 1Tinjauan manualgke

Deskripsi

Use dedicated namespaces to separate GKE Standard workloads by application, team, environment, or tenant. Namespaces provide a logical boundary for organizing resources and applying namespace level governance, but they should be paired with access, quota, network, and pod security controls. The benchmark marks this recommendation Manual.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Run the following command and review the namespaces created in the cluster: kubectl get namespaces --show-labels Verify that user workloads are placed in dedicated namespaces based on application, environment, or tenant, rather than being deployed into the default namespace. In addition, confirm that each workload namespace has both ownership and appropriate namespace level controls, such as RBAC RoleBindings, ResourceQuotas, NetworkPolicies, and Pod Security labels where required.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Create dedicated namespaces for GKE workloads based on application, environment, or tenant boundaries. Move production workloads out of the default namespace and apply consistent namespace level governance so administration, access, and resource controls are easier to manage. • Create a dedicated namespace before deploying new application resources. • Move production workloads out of the default namespace where applicable. • Apply namespace labels for owner, application, environment, tenant, and cost allocation. • Configure least privilege RBAC using namespace level Roles and RoleBindings where possible. • Apply ResourceQuotas, NetworkPolicies, and Pod Security labels based on workload risk and governance requirements. Review namespaces, owners, workload placement, and access bindings to confirm that the namespace model still matches current application and environment boundaries.

Properti

Sistem operasi: Apa saja
Tag: gkepolicies
Referensi: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.6.1 Use namespaces to separate workload administration and resource governance