question

IamCoder-6455 avatar image
0 Votes"
IamCoder-6455 asked IamCoder-6455 commented

how to avoid resource creation in “default” namespace during cluster creation

I am trying to create K8s cluster in Azure AKS and when cluster is ready I can see couple of resource is creating within "default" namespace. Example secret, configmap,

125212-capture.png







The security recommendation from Azure Policy is "Kubernetes clusters should not use the default namespace", then WHY resource created within "default" namespace and how to avoid it?

azure-kubernetes-service
capture.png (41.4 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

srbose-msft avatar image
1 Vote"
srbose-msft answered IamCoder-6455 commented

@IamCoder-6455 , Thank you for your question.

In Kubernetes, a ServiceAccount controller manages the ServiceAccounts inside namespaces, and ensures a ServiceAccount named "default" exists in every active namespace. [Reference]

TokenController runs as part of kube-controller-manager. It acts asynchronously. It watches ServiceAccount creation and creates a corresponding ServiceAccount token Secret to allow API access. [Reference] Thus, the secret for the default ServiceAccount token is also created.

Trusting the custom CA from an application running as a pod usually requires some extra application configuration. You will need to add the CA certificate bundle to the list of CA certificates that the TLS client or server trusts. For example, you would do this with a golang TLS config by parsing the certificate chain and adding the parsed certificates to the RootCAs field in the tls.Config struct.

You can distribute the CA certificate as a ConfigMap that your pods have access to use. [Reference] AKS implements this in all active namespaces through ConfigMaps named kube-root-ca.crt in these namespaces.

You shall also find a Service named kubernetes in the default namespace. It has a ServiceType of ClusterIP and exposes the API Server Endpoint also named kubernetes internally to the cluster in the default namespace.

All the resources mentioned above will be created by design at the time of cluster creation and their creation cannot be prevented. If you try to remove these resources manually, they will be recreated to ensure desired goal state by the kube-controller-manager.


Hope this helps.

Please "Accept as Answer" if it helped, so that it can help others in the community looking for help on similar topics.

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks @srbose-msft for your detailed reply. I understand that it's required by design, then why Microsoft has a security recommendation around those recourses which is part of design ?


125359-capture.png?


0 Votes 0 ·
capture.png (47.5 KiB)

@IamCoder-6455 , Thank you for your response.

The Kubernetes clusters should not use the default namespace Policy is still in Preview. Currently the schema does not explicitly allow for Kubernetes resources in the default namespace to be excluded during policy evaluation. However, at the time of writing, the schema allows for labelSelector.matchExpressions[].operator which can be set to NotIn with appropriate labelSelector.matchExpressions[].values for the Service default/kubernetes with label:

 component=apiserver

The default ServiceAccount, the default ServiceAccount token Secret and the RootCA ConfigMap themselves are not created with any labels and hence cannot to added to this list. If this is impeding your use-case I would urge you to share your feedback at https://techcommunity.microsoft.com/t5/azure/ct-p/Azure

1 Vote 1 ·

Thanks for clarifying. Appreciate.

0 Votes 0 ·