About

Imported from CyberStrikeus/CyberStrike (.cyberstrike/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_Amazon_EKS_Benchmark_v1.6.0/cis-eks-v160-4.5.1/SKILL.md). Install upstream with npx skills add CyberStrikeus/CyberStrike --skill cis-eks-v160-4.5.1. Copyright stays with the author.

4.5.1 Create administrative boundaries between resources using namespaces (Manual)

Name: cis-eks-v160-4.5.1
Author: CyberStrikeus

Profile Applicability

Level 1

Description

Use namespaces to isolate your Kubernetes objects.

Rationale

Limiting the scope of user permissions can reduce the impact of mistakes or malicious activities. A Kubernetes namespace allows you to partition created resources into logically named groups. Resources created in one namespace can be hidden from other namespaces. By default, each resource created by a user in an Amazon EKS cluster runs in a default namespace, called default. You can create additional namespaces and attach resources and users to them. You can use Kubernetes Authorization plugins to create policies that segregate access to namespace resources between different users.

Impact

You need to switch between namespaces for administration.

Audit Procedure

Run the below command and review the namespaces created in the cluster.

kubectl get namespaces

Ensure that these namespaces are the ones you need and are adequately administered as per your requirements.

Remediation

Follow the documentation and create namespaces for objects in your deployment as you need them.

Default Value

By default, Kubernetes starts with four initial namespaces:

default - The default namespace for objects with no other namespace
kube-system - The namespace for objects created by the Kubernetes system
kube-public - The namespace for public-readable ConfigMap
kube-node-lease - The namespace for associated lease object for each node

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work			x
v7	12.1 Maintain an Inventory of Network Boundaries	x	x	x

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/cyberstrikeus-cyberstrike-cis-eks-v160-4-5-1/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

cyberstrikeus-cyberstrike-cis-eks-v160-4-5-1.ocm.jsonjson

{
  "ocm": "1",
  "id": "cyberstrikeus-cyberstrike-cis-eks-v160-4-5-1",
  "kind": "skill",
  "name": "cis-eks-v160-4.5.1",
  "description": "Create administrative boundaries between resources using namespaces (Manual)",
  "publisher": "CyberStrikeus",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "cis",
      "eks",
      "kubernetes",
      "aws",
      "general-policies",
      "namespaces",
      "resource-isolation",
      "multi-tenancy",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Create administrative boundaries between resources using namespaces (Manual)"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/CyberStrikeus/CyberStrike",
      "path": ".cyberstrike/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_Amazon_EKS_Benchmark_v1.6.0/cis-eks-v160-4.5.1/SKILL.md",
      "ref": "df28ccd3dc6d6c02391169121ee2dcdf4a6a132b",
      "url": "https://github.com/CyberStrikeus/CyberStrike/blob/df28ccd3dc6d6c02391169121ee2dcdf4a6a132b/.cyberstrike/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_Amazon_EKS_Benchmark_v1.6.0/cis-eks-v160-4.5.1/SKILL.md",
      "key": "CyberStrikeus/CyberStrike/.cyberstrike/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_Amazon_EKS_Benchmark_v1.6.0/cis-eks-v160-4.5.1/SKILL.md"
    }
  },
  "instructions": "# 4.5.1 Create administrative boundaries between resources using namespaces (Manual)\n\n## Profile Applicability\n\n- Level 1\n\n## Description\n\nUse namespaces to isolate your Kubernetes objects.\n\n## Rationale\n\nLimiting the scope of user permissions can reduce the impact of mistakes or malicious activities. A Kubernetes namespace allows you to partition created resources into logically named groups. Resources created in one namespace can be hidden from other namespaces. By default, each resource created by a user in an Amazon EKS cluster runs in a default namespace, called `default`. You can create ",
  "cost": {
    "context_tokens": 578
  }
}

Fetch it by URL: GET /api/v1/registry/cyberstrikeus-cyberstrike-cis-eks-v160-4-5-1/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.