Detections
Analytics

4.6.1 Use namespaces to separate workload administration and resource governance

Information

Use dedicated namespaces to separate GKE Standard workloads by application, team, environment, or tenant. Namespaces provide a logical boundary for organizing resources and applying namespace level governance, but they should be paired with access, quota, network, and pod security controls.

Namespaces help reduce administrative risk by limiting where users and workloads operate inside the cluster. GKE supports namespace restricted access patterns where IAM and Kubernetes RBAC work together, and RBAC should grant permissions in as few namespaces as possible using Roles and RoleBindings where practical. This reduces the blast radius of mistakes, unauthorized changes, and overly broad operational access.

Dedicated namespaces also make it easier to apply workload governance consistently, including ResourceQuotas, NetworkPolicies, Pod Security labels, ownership labels, and environment specific deployment rules. Workloads should not be placed in the default namespace for production because shared use can increase naming collisions, resource contention, weak access separation, and cleanup complexity.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Create dedicated namespaces for GKE workloads based on application, environment, or tenant boundaries. Move production workloads out of the default namespace and apply consistent namespace level governance so administration, access, and resource controls are easier to manage.

 -

Create a dedicated namespace before deploying new application resources.

 -

Move production workloads out of the default namespace where applicable.

 -

Apply namespace labels for owner, application, environment, tenant, and cost allocation.

 -

Configure least privilege RBAC using namespace level Roles and RoleBindings where possible.

 -

Apply ResourceQuotas, NetworkPolicies, and Pod Security labels based on workload risk and governance requirements.

Review namespaces, owners, workload placement, and access bindings to confirm that the namespace model still matches current application and environment boundaries.

Impact:

Admins must specify the correct namespace when deploying, troubleshooting, and granting access to workloads. Namespace based administration can require additional RBAC bindings, quotas, labels, NetworkPolicies, and operational standards, but it improves ownership, access control, and resource governance across shared GKE Standard clusters.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CSCv7|12

Plugin: GCP

Control ID: af3d9cce4cab247b0c16576c5478cae3e8e058f9bd553fc64c3ea1f2c610e787