1.6.3 Create network segmentation using Network Policies

Information

Use network policies to isolate your cluster network.

Rationale:

Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate only with those they are supposed to. A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. 'NetworkPolicy' resources use labels to select pods and define whitelist rules which allow traffic to the selected pods in addition to what is allowed by the isolation policy for a given namespace.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Follow the documentation and create 'NetworkPolicy' objects as you need them.

Impact:

You need a networking solution which supports 'NetworkPolicy' - simply creating the resource without a controller to implement it will have no effect.

See Also

https://workbench.cisecurity.org/files/2125

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(21), CSCv6|14.1

Plugin: Unix

Control ID: ccd11922eb5d16911ec603126bd88466a1935fddfbecb6bd880c7c5e0ec6469a