sigs.k8s.io/multi-tenancy/benchmarks

Multi-Tenancy Benchmarks

Multi-Tenancy Benchmarks (MTB) are guidelines for multi-tenant configuration of Kubernetes clusters.

The kubectl plugin kubectl-mtb can be used to validate if a Kubernetes cluster is properly configured for multi-tenancy.

Multi-Tenancy Benchmarks are meant to be used as part of a comprehensive security strategy. They are not a substitute for other security best practices and do not guarantee security.

For background, see: Multi-Tenancy Benchmarks Proposal.

Status

The multi-tenancy benchmarks are in development and not ready for usage.

Documentation

• Multi-tenancy Definitions
• Benchmark Profiles
• Benchmark Types
• Benchmark Categories
• Running benchmark validation tests with kubectl-mtb
• Contributing to the benchmarks

Benchmarks

The following tests are currently defined (tests marked pending are planned for implementation):

Profile Level 1

• Block access to cluster resources
• Block access to Multitenant Resources
• Block access to other tenant resources (pending #1197)
• Block add capabilities
• Require image pull always
• Require run as non-root user
• Block privileged containers
• Block privilege escalation
• Configure namespace resource quotas
• Configure namespace object limits
• Block use of host path volumes
• Block use of NodePort services
• Block use of host networking and ports
• Block use of host PID
• Block use of host IPC
• Block modification of resource quotas
• Require PersistentVolumeClaim for storage (pending #1198)
• Require PV reclaim policy of delete (pending #1199)
• Block use of existing PVs (pending #1200)
• Block network access across tenant namespaces (pending #1201)

Profile Level 2

• Allow self-service management of Network Policies
• Allow self-service management of Roles (pending #1202)
• Allow self-service management of Roles Bindings (pending #1203)