Create administrative boundaries between resources using namespaces

НизкийУровень 1Ручная проверкаeks

Описание

Namespaces create administrative boundaries in EKS by dividing a cluster into logical partitions for teams, applications, or tenants. They are a core building block for soft multi-tenancy, and several controls used to separate workloads, including quotas, network policies, and service accounts, are scoped to the namespace. The benchmark marks this recommendation Manual.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Verify that namespaces are present and are being used as intentional administrative boundaries for teams, applications, or environments in the EKS cluster. Namespaces are the core logical partition for soft multi-tenancy, and they should be paired with scoped access controls and namespace-level governance such as quotas, limits, and network policies. A namespace should be considered adequately administered only when it has a clear workload or team purpose, appropriately scoped access, and the namespace-level controls required for that use case.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Create separate namespaces for teams, applications, or environments that require their own administrative scope, and move workloads out of the default namespace into that managed namespace structure. Make the namespace boundary meaningful by scoping access to the intended namespaces, applying namespace-level governance such as quotas, limits, service accounts, and network policies, and reducing cluster-wide permissions that bypass the intended separation model. When stronger isolation is required for mutually untrusted workloads, use separate clusters rather than relying on namespaces alone. 1. Create dedicated namespaces for each team, application, or environment that needs its own administrative boundary. 2. Move user workloads out of the default namespace and into the appropriate managed namespaces. 3.

Свойства

Операционные системы: Любая
Теги: ekspolicies
Источник: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.5.1 Create administrative boundaries between resources using namespaces