Namespace isolation

Jan 1, 0001

Definition

Namespace isolation is a security and resource management technique used in container orchestration platforms like Kubernetes to separate and control access to resources within a cluster. Each namespace provides a scope for names, allowing resources to be organized and managed independently. This isolation helps in enforcing security boundaries, preventing unauthorized access, and managing resource allocation efficiently.

Secure Settings Example

apiVersion: v1
kind: Namespace
metadata:
  name: secure-namespace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: secure-namespace
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: secure-namespace
subjects:
- kind: User
  name: jane-doe
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Insecure Settings Example

apiVersion: v1
kind: Namespace
metadata:
  name: insecure-namespace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: insecure-namespace
  name: admin
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: admin-binding
  namespace: insecure-namespace
subjects:
- kind: User
  name: john-doe
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: admin
  apiGroup: rbac.authorization.k8s.io