block application resources in default namespace

2026-08-10 18:01:00 -04:00
parent 1c1e9dc394
commit e389331a07
4 changed files with 50 additions and 7 deletions
@@ -12,8 +12,8 @@ and avoids applying workload admission rules to platform namespaces.
 | 5.2.7 | `require-non-root` | A Pod without explicit non-root execution is rejected. | Does not prove the image cannot switch users internally. |
 | 5.5.1 | `restrict-image-registries` | Images outside the approved registry set are rejected. | Full provenance needs signing, verification, and trusted build controls. |
 | 5.7.3 supplemental | `require-resource-limits` | Pods must declare CPU and memory limits. | Resource limits are a defense-in-depth control, not a direct CIS test. |
+| Supplemental | `disallow-default-namespace` | Common application resources in `default` are rejected. | Namespace hygiene is defense in depth, not a one-to-one CIS test. |

 The Kubernetes CIS Benchmark is broader than admission policy. kube-bench
 covers node, control-plane, RBAC, audit, network policy, and manual review
 areas that these Kyverno policies do not implement.
-