Create administrative boundaries between resources using namespaces

NiskaNivo 1Ručni pregledeks

Opis

Namespaces create administrative boundaries in EKS by dividing a cluster into logical partitions for teams, applications, or tenants. They are a core building block for soft multi-tenancy, and several controls used to separate workloads, including quotas, network policies, and service accounts, are scoped to the namespace. The benchmark marks this recommendation Manual.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Verify that namespaces are present and are being used as intentional administrative boundaries for teams, applications, or environments in the EKS cluster. Namespaces are the core logical partition for soft multi-tenancy, and they should be paired with scoped access controls and namespace-level governance such as quotas, limits, and network policies. A namespace should be considered adequately administered only when it has a clear workload or team purpose, appropriately scoped access, and the namespace-level controls required for that use case.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Create separate namespaces for teams, applications, or environments that require their own administrative scope, and move workloads out of the default namespace into that managed namespace structure. Make the namespace boundary meaningful by scoping access to the intended namespaces, applying namespace-level governance such as quotas, limits, service accounts, and network policies, and reducing cluster-wide permissions that bypass the intended separation model. When stronger isolation is required for mutually untrusted workloads, use separate clusters rather than relying on namespaces alone. 1. Create dedicated namespaces for each team, application, or environment that needs its own administrative boundary. 2. Move user workloads out of the default namespace and into the appropriate managed namespaces. 3.

Svojstva

Operativni sistemi: Bilo koji
Oznake: ekspolicies
Referenca: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.5.1 Create administrative boundaries between resources using namespaces