Ensure that all Namespaces have Network Policies defined

中级别 2人工审核openshift

说明

Use network policies to isolate traffic in your cluster network. The benchmark marks this recommendation Manual.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

The OpenShift 4 CNI plugin uses network policies and by default all Pods in a project are accessible from other Pods and network endpoints. To isolate one or more Pods in a project, you create NetworkPolicy objects in that project to indicate the allowed incoming connections. Project administrators can create and delete NetworkPolicy objects within their own project. For more information see: Run the following command and review the NetworkPolicy objects created in the cluster.

修复方式

修复方法: 操作指南或基础设施补丁

Follow the documentation and create NetworkPolicy objects as you need them.

属性

操作系统: 任意
标签: openshiftpoliciesnetwork
参考: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 5.3.2 Ensure that all Namespaces have Network Policies defined