| name | cis-gke-autopilot-v100-4.6.4 |
| description | The default namespace should not be used (Automated) |
| category | cis-gke-autopilot |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","gke-autopilot","kubernetes","gcp","general-policies","namespaces","default-namespace"] |
| cis_id | 4.6.4 |
| cis_benchmark | CIS Google Kubernetes Engine (GKE) Autopilot Benchmark v1.0.0 |
| tech_stack | ["kubernetes","gcp","gke"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
4.6.4 The default namespace should not be used (Automated)
Profile Applicability
Description
Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes application of RBAC and other controls more difficult.
Rationale
Resources in a Kubernetes cluster should be segregated by namespace, to allow for security controls to be applied at that level and to make it easier to manage resources.
Impact
None
Audit
Run this command to list objects in default namespace:
kubectl get $(kubectl api-resources --verbs=list --namespaced=true -o name | paste -sd, -) --ignore-not-found -n default
The only entries there should be system managed resources such as the kubernetes service.
OR
kubectl get pods -n default
Returning No resources found in default namespace.
Remediation
Ensure that namespaces are created to allow for appropriate segregation of Kubernetes resources and that all new resources are created in a specific namespace.
Default Value
Unless a namespace is specific on object creation, the default namespace will be used.
References
- https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|
| v8 | 4 Secure Configuration of Enterprise Assets and Software | | | |
| v7 | 5.1 Establish Secure Configurations | * | * | * |
