The Default Namespace Should Not Be Used

kubectl get $(kubectl api-resources --verbs=list --namespaced=true -o name | paste -sd, -) \
  --ignore-not-found -n default \
  -o wide

cat << 'EOF' | kubectl apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: my-app
EOF

# Example: move deployments, services, configmaps, secrets for one app label
kubectl get deploy,svc,configmap,secret \
  -n default -l app=my-app \
  -o yaml \
| sed 's/namespace: default/namespace: my-app/g' \
| sed '/^\s*uid:/d;/^\s*resourceVersion:/d;/^\s*creationTimestamp:/d;/^\s*selfLink:/d;/^\s*managedFields:/d' \
| kubectl apply -f -

kubectl delete deploy,svc,configmap,secret \
  -n default -l app=my-app

kubectl label namespace default usage=discouraged --overwrite
kubectl annotate namespace default \
  "note=do-not-deploy-user-workloads-here" \
  --overwrite

output=$(kubectl get $(kubectl api-resources --verbs=list --namespaced=true -o name | paste -sd, -) --ignore-not-found -n default 2>/dev/null | grep -v "^kubernetes ")
if [ -z "$output" ]; then
  echo "NO_USER_RESOURCES_IN_DEFAULT"
else
  echo "USER_RESOURCES_IN_DEFAULT_FOUND: $output"
fi

#!/usr/bin/env bash
set -euo pipefail

# Automation for: "The Default Namespace Should Not Be Used"
# Scope: run on any machine with kubectl access and correct context.
#
# Behavior:
# - Detect all namespaced resources currently in the "default" namespace
# - For each resource, interactively choose a non-default target namespace
#   (creating it if necessary)
# - Move the resource by exporting manifest, adjusting metadata.namespace
#   and metadata.annotations, then re-creating in the target namespace
#   and deleting the original
# - Safe to re-run: already-moved resources will not be in "default"
# - Final verification uses the benchmark's audit logic

# --------------- helper functions ---------------

require_kubectl() {
  if ! command -v kubectl >/dev/null 2>&1; then
    echo "ERROR: kubectl not found in PATH" >&2
    exit 1
  fi
}

prompt_namespace() {
  local current_ns="$1"
  local target_ns
  while true; do
    read -r -p "Enter target namespace for resources currently in '${current_ns}' (not 'default'): " target_ns
    target_ns="${target_ns:-}"
    if [[ -z "${target_ns}" ]]; then
      echo "Namespace cannot be empty."
      continue
    fi
    if [[ "${target_ns}" == "default" ]]; then
      echo "Target namespace must not be 'default'."
      continue
    fi
    echo "${target_ns}"
    return 0
  done
}

ensure_namespace_exists() {
  local ns="$1"
  if ! kubectl get namespace "${ns}" >/dev/null 2>&1; then
    echo "Creating namespace '${ns}'..."
    kubectl create namespace "${ns}"
  else
    echo "Namespace '${ns}' already exists."
  fi
}

move_resource() {
  local kind="$1"
  local name="$2"
  local src_ns="$3"
  local dst_ns="$4"

  echo "Moving ${kind}/${name} from namespace '${src_ns}' to '${dst_ns}'..."

  # Export the resource as YAML, strip status, cluster-specific fields,
  # and force target namespace.
  tmpfile="$(mktemp)"
  trap 'rm -f "${tmpfile}"' RETURN

  if ! kubectl get "${kind}" "${name}" -n "${src_ns}" -o yaml > "${tmpfile}"; then
    echo "  WARN: Failed to get ${kind}/${name} in namespace '${src_ns}', skipping."
    return 0
  fi

  # Clean up fields that prevent re-creation and adjust namespace
  # - remove status
  # - remove metadata fields that should not be re-applied
  # - set metadata.namespace to dst_ns
  # Using yq would be nicer but we assume only kubectl and core tools.
  # Do minimal, robust transforms with sed/awk.
  cleaned="$(mktemp)"
  trap 'rm -f "${tmpfile}" "${cleaned}"' RETURN

  awk '
    $1=="status:"{in_status=1}
    !in_status{print}
    in_status && NF==0{in_status=0}
  ' "${tmpfile}" > "${cleaned}"

  # Remove certain metadata fields (uid, resourceVersion, etc.)
  # This is a best-effort textual cleanup.
  sed -i '/^[[:space:]]*uid:/d' "${cleaned}"
  sed -i '/^[[:space:]]*resourceVersion:/d' "${cleaned}"
  sed -i '/^[[:space:]]*generation:/d' "${cleaned}"
  sed -i '/^[[:space:]]*creationTimestamp:/d' "${cleaned}"
  sed -i '/^[[:space:]]*managedFields:/,/^[^[:space:]]/d' "${cleaned}"

  # Set / override namespace in metadata
  if grep -q '^[[:space:]]*namespace:' "${cleaned}"; then
    sed -i "s/^\([[:space:]]*namespace:\).*/\1 ${dst_ns}/" "${cleaned}"
  else
    # Insert namespace under metadata:
    awk -v ns="${dst_ns}" '
      /^metadata:[[:space:]]*$/ && !added {
        print $0
        print "  namespace: " ns
        added=1
        next
      }
      {print}
    ' "${cleaned}" > "${cleaned}.ns" && mv "${cleaned}.ns" "${cleaned}"
  fi

  # Annotate that this was moved from default (best-effort)
  if ! grep -q 'annotations:' "${cleaned}"; then
    awk '
      /^metadata:[[:space:]]*$/ && !added {
        print $0
        print "  annotations:"
        print "    moved-from-default-namespace: \"true\""
        added=1
        next
      }
      {print}
    ' "${cleaned}" > "${cleaned}.ann" && mv "${cleaned}.ann" "${cleaned}"
  else
    awk '
      /^  annotations:[[:space:]]*$/ && !added {
        print $0
        print "    moved-from-default-namespace: \"true\""
        added=1
        next
      }
      {print}
    ' "${cleaned}" > "${cleaned}.ann" && mv "${cleaned}.ann" "${cleaned}"
  fi

  # Apply into target namespace
  if ! kubectl apply -f "${cleaned}" --namespace "${dst_ns}"; then
    echo "  ERROR: Failed to create ${kind}/${name} in namespace '${dst_ns}'. Original not deleted."
    return 1
  fi

  # Delete original
  kubectl delete "${kind}" "${name}" -n "${src_ns}" --ignore-not-found

  echo "  Moved ${kind}/${name} -> namespace '${dst_ns}'."
}

# --------------- main logic ---------------

require_kubectl

echo "Discovering namespaced resource types..."
resource_types="$(kubectl api-resources --verbs=list --namespaced=true -o name | paste -sd, -)"

if [[ -z "${resource_types}" ]]; then
  echo "No namespaced resource types discovered. Nothing to do."
  exit 0
fi

echo "Listing resources in the 'default' namespace..."
# Skip the default "kubernetes" service as per audit command
output_raw="$(kubectl get ${resource_types} --ignore-not-found -n default 2>/dev/null | grep -v '^kubernetes ' || true)"

if [[ -z "${output_raw}" ]]; then
  echo "No user-defined resources found in the 'default' namespace."
  exit 0
fi

echo "User-defined resources currently in 'default' namespace:"
echo "${output_raw}"
echo

target_ns="$(prompt_namespace "default")"
ensure_namespace_exists "${target_ns}"

echo
echo "Moving resources from 'default' to '${target_ns}'..."

# For each resource type, list names in default and move
IFS=',' read -r -a kinds <<< "${resource_types}"

for kind in "${kinds[@]}"; do
  # Get "kind/name" list; skip no-resources error
  mapfile -t lines < <(kubectl get "${kind}" -n default --ignore-not-found -o name 2>/dev/null || true)
  if [[ "${#lines[@]}" -eq 0 ]]; then
    continue
  fi
  for full in "${lines[@]}"; do
    # full is of form kind/name
    res_name="${full#*/}"
    move_resource "${kind}" "${res_name}" "default" "${target_ns}"
  done
done

echo
echo "Verifying that no user-defined resources remain in the 'default' namespace..."

verification_output="$(
  output=$(kubectl get $(kubectl api-resources --verbs=list --namespaced=true -o name | paste -sd, -) --ignore-not-found -n default 2>/dev/null | grep -v "^kubernetes " || true)
  if [ -z "$output" ]; then
    echo "NO_USER_RESOURCES_IN_DEFAULT"
  else
    echo "USER_RESOURCES_IN_DEFAULT_FOUND: $output"
  fi
)"

echo "Verification result: ${verification_output}"

if [[ "${verification_output}" == "NO_USER_RESOURCES_IN_DEFAULT" ]]; then
  echo "Success: default namespace no longer contains user-defined resources."
  exit 0
else
  echo "WARNING: Some resources remain in the default namespace. Review output above."
  exit 1
fi