+APP.4.4.A7 Separation of Networks for Kubernetes (S)

APP.4.4.A7 Separation of Networks for Kubernetes (S)

Networks for the administration of nodes, the control plane, and the individual networks of application services SHOULD be separated.

Only the network ports of the pods necessary for operation SHOULD be released into the designated networks. If a Kubernetes cluster contains multiple applications, all the network connections between the Kubernetes namespaces SHOULD first be prohibited and only required network connections permitted (whitelisting). The network ports necessary for the administration of the nodes, the runtime, and Kubernetes (including its extensions) SHOULD ONLY be accessible from the corresponding administration network and from pods that need them.

Only selected administrators SHOULD be authorised in Kubernetes to manage the CNI and create or change rules for the network.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.14 Interception of Information / Espionage
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.39 Malware
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information