Create administrative boundaries between resources using namespaces

낮음레벨 1수동 검토aks

설명

Create administrative boundaries between resources by organizing AKS workloads into separate namespaces and scoping access to those namespaces with Kubernetes RBAC or Azure RBAC for Kubernetes Authorization. Namespaces form the logical isolation boundary for workloads and resources, and Kubernetes RBAC can scope permissions to a single namespace or across the entire cluster. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Verify that namespaces are not only present, but are being used as intentional administrative boundaries for teams, applications, or environments within the AKS cluster. Namespaces are the logical isolation boundary for workloads and resources in a shared cluster, and they should be paired with scoped access controls and other namespace-level governance such as quotas and network policies. Namespaces alone are not sufficient for hostile multitenancy, so the audit should focus on whether they are being used consistently to separate administration and operations as intended.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Microsoft recommends namespaces as the logical isolation boundary for workloads and resources in shared clusters, combined with namespace-level governance such as quotas and network policies; where stronger tenant isolation is required, Microsoft recommends separate clusters rather than relying on namespaces alone. 1. Create separate namespaces for each team, application, or environment that requires its own administrative scope. 2. Move workloads out of the default namespace and into the appropriate managed namespace structure. 3. Rebind access using namespace-scoped Role and RoleBinding objects, or namespace-scoped Azure RBAC assignments where applicable. 4. Apply namespace-level controls such as resource quotas and network policies to reinforce the administrative boundary. 5. Remove unused namespaces and reduce cluster-wide permissions that bypass intended namespace separation.

속성

운영 체제: 모두
태그: akspolicies
참고 자료: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 4.6.1 Create administrative boundaries between resources using namespaces