Hands-on Lab·Kubernetes and Cloud Native Security Associate
Namespaces as a Security Boundary
Namespaces are the most over-trusted object in Kubernetes. This guide shows the same boundary holding on one axis and doing nothing at all on another, with two commands.
Security Fundamentals Guide 23 of 42 Beginner
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1
- Built withkubeadm v1.36.3
- TimeAbout 12 min
Cilium 1.18.1 is the CNI - or rather, is not enforcing anything, since no policy exists. The behaviour shown is the Kubernetes default and is the same under any conformant CNI.
- Host kernel7.0.0-29
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA5001 | 192.168.0.41 | Ubuntu 26.04 LTS | Control Plane Node (tainted NoSchedule) | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE01 | 192.168.0.42 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE02 | 192.168.0.43 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE03 | 192.168.0.44 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when a namespace is being treated as an isolation boundary. This matters because it is one on the API and is not one on the network - two Pods in different namespaces reach each other perfectly well by default.
- pinging across two namespaces with no policy anywhere, and succeeding
- asking the same question of the API instead, and getting the opposite answer
- stating where a namespace really is a boundary - Roles and RoleBindings are namespaced, so nothing was ever granted across
Before you start
- guide 8 - the control that does bound the network.
-
Two namespaces, two Pods, one ping
-
The same boundary, on the API