CNTR-R2-000970 Rancher RKE2 runtime must maintain separate execution domains for each container by assigning each container a separate address space to prevent unauthorized and unintended information transfer via shared system resources.

Information

Separating user functionality from management functionality is a requirement for all the components within the Kubernetes Control Plane. Without the separation, users may have access to management functions that can degrade the Kubernetes architecture and the services being offered, and can offer a method to bypass testing and validation of functions before introduced into a production environment.

Satisfies: SRG-APP-000243-CTR-000600, SRG-APP-000431-CTR-001065, SRG-APP-000211-CTR-000530, SRG-APP-000243-CTR-000595

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

System namespaces are reserved and isolated.

A resource cannot move to a new namespace; the resource must be deleted and recreated in the new namespace.

kubectl delete <resource_type> <resource_name>
kubectl create -f <resource.yaml> --namespace=<user_created_namespace>

See Also

https://workbench.cisecurity.org/benchmarks/0

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-2, 800-53|SC-4, 800-53|SC-39, CAT|II, CCI|CCI-001082, CCI|CCI-001090, CCI|CCI-002530, Rule-ID|SV-254570r1016539_rule, STIG-ID|CNTR-R2-000970, Vuln-ID|V-254570

Plugin: Unix

Control ID: d31912e13065f52ab378db10dc898a292949d9fa516f86b3b246cb87373a60fa