1.6.3 Create network segmentation using Network Policies

Information

Use network policies to isolate your cluster network.

Rationale:

Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate only with those they are supposed to. A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. 'NetworkPolicy' resources use labels to select pods and define whitelist rules which allow traffic to the selected pods in addition to what is allowed by the isolation policy for a given namespace.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Follow the documentation and create 'NetworkPolicy' objects as you need them.

See Also

https://workbench.cisecurity.org/files/2421

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|CA-9, 800-53|SC-7(22), 800-53|SI-4, CSCv6|14.1, CSCv7|14.1, CSCv7|14.2

Plugin: Unix

Control ID: 8a43d8b9e472854f6b2ba2dab30a465dde6f5a334469e825ae311dcfaccb40d0