Use namespaces to separate workload administration and resource governance

SrednjaNivo 1Ručni pregledgke

Opis

Use dedicated namespaces to separate GKE Standard workloads by application, team, environment, or tenant. Namespaces provide a logical boundary for organizing resources and applying namespace level governance, but they should be paired with access, quota, network, and pod security controls. The benchmark marks this recommendation Manual.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Run the following command and review the namespaces created in the cluster: kubectl get namespaces --show-labels Verify that user workloads are placed in dedicated namespaces based on application, environment, or tenant, rather than being deployed into the default namespace. In addition, confirm that each workload namespace has both ownership and appropriate namespace level controls, such as RBAC RoleBindings, ResourceQuotas, NetworkPolicies, and Pod Security labels where required.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Create dedicated namespaces for GKE workloads based on application, environment, or tenant boundaries. Move production workloads out of the default namespace and apply consistent namespace level governance so administration, access, and resource controls are easier to manage. • Create a dedicated namespace before deploying new application resources. • Move production workloads out of the default namespace where applicable. • Apply namespace labels for owner, application, environment, tenant, and cost allocation. • Configure least privilege RBAC using namespace level Roles and RoleBindings where possible. • Apply ResourceQuotas, NetworkPolicies, and Pod Security labels based on workload risk and governance requirements. Review namespaces, owners, workload placement, and access bindings to confirm that the namespace model still matches current application and environment boundaries.

Svojstva

Operativni sistemi: Bilo koji
Oznake: gkepolicies
Referenca: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.6.1 Use namespaces to separate workload administration and resource governance