V-242417—Kubernetes must separate user functionality.
CAT II - Medium
CNTR-K8-001360
>Control Description
Separating user functionality from management functionality is a requirement for all the components within the Kubernetes Control Plane. Without the separation, users may have access to management functions that can degrade the Kubernetes architecture and the services being offered, and can offer a method to bypass testing and validation of functions before introduced into a production environment.
>Check Content
On the Control Plane,
$kubectl get pods --all-namespaces Review the namespaces and pods that are returned. Kubernetes system namespaces are kube-node-lease, kube-public, and kube-system.If any user pods are present in the Kubernetes system namespaces, this is a finding.
>Remediation
Move any user pods that are present in the Kubernetes system namespaces to user specific namespaces.
>CCI References
Control Correlation Identifiers (CCIs) map STIG findings to NIST 800-53 controls.
>Cross-Framework Mappings
NIST SP 800-53 r5
via DISA CCI ListAsk AI
Configure your API key to use AI features.