Details

Creating namespaces for user-managed resources is important when implementing Role-Based Access Controls (RBAC). RBAC allows for the authorization of users and helps support proper API server permissions separation and network micro segmentation. If user-managed resources are placed within the default namespaces, it becomes impossible to implement policies for RBAC permission, service account usage, network policies, and more.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Move any user-managed resources from the default, kube-public and kube-node-lease namespaces, to user namespaces.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Kubernetes_V1R4_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-6b.
• CAT|I
• CCI|CCI-000366
• Rule-ID|SV-242383r712505_rule
• STIG-ID|CNTR-K8-000290
• Vuln-ID|V-242383

Source

• Tenable.com/audits