The Default Namespace Should Not Be Used

kubectl get all -n default
kubectl get configmaps,secrets,serviceaccounts,roles,rolebindings -n default

cat << 'EOF' | kubectl apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: team-a
EOF

kubectl get deployment <DEPLOYMENT_NAME> -n default -o yaml \
  | sed 's/namespace: default/namespace: team-a/' \
  | sed '/resourceVersion:/d' \
  | sed '/uid:/d' \
  | sed '/creationTimestamp:/d' \
  | sed '/selfLink:/d' \
  | sed '/managedFields:/,$d' \
  | kubectl apply -f -

kubectl get service <SERVICE_NAME> -n default -o yaml \
  | sed 's/namespace: default/namespace: team-a/' \
  | sed '/resourceVersion:/d' \
  | sed '/uid:/d' \
  | sed '/creationTimestamp:/d' \
  | sed '/selfLink:/d' \
  | sed '/clusterIP:/!b;n;s/.*/  clusterIP: None/' \
  | kubectl apply -f -

kubectl delete deployment,replicaset,pod,service,statefulset,daemonset,job,cronjob \
  --all -n default
kubectl delete configmap,secret,serviceaccount,role,rolebinding \
  --all -n default

cat << 'EOF' | kubectl apply -f -
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sNoDefaultNamespace
metadata:
  name: forbid-default-namespace
spec:
  match:
    namespaces:
    - default
    kinds:
    - apiGroups: [""]
      kinds: ["Pod","Service","ConfigMap","Secret","ServiceAccount"]
EOF

output=$(kubectl get all -n default --no-headers 2>/dev/null | grep -v '^service\s\+kubernetes\s' || true)
if [ -z "$output" ]; then echo "DEFAULT_NAMESPACE_UNUSED"; else echo "DEFAULT_NAMESPACE_IN_USE"; fi

#!/usr/bin/env bash
#
# Purpose:
#   Help enforce “do not use the default namespace” by:
#     - Identifying all non-system workloads in the default namespace
#     - Optionally migrating them to a target namespace
#     - Verifying that the default namespace contains no non-kubernetes service objects
#
# Scope:
#   Run on any machine with kubectl access and appropriate RBAC.
#
# Notes:
#   - This is a MANUAL benchmark control: there is no universally safe, fully
#     automated fix. This script assists review and migration; you must confirm
#     each move.
#   - Changing namespaces requires delete+recreate of most objects; this script
#     generates manifests for review and then applies them to the target namespace.
#   - ClusterIP/LoadBalancer/Ingress and other dependencies may need manual
#     adjustments. Review carefully before approving migrations.

set -euo pipefail

# --------- CONFIGURATION ---------
# Target namespace to migrate workloads into, e.g. "apps" or "team-a".
# Must be a non-empty string and not "default" or "kube-system".
TARGET_NAMESPACE="${TARGET_NAMESPACE:-apps}"

# Set to "yes" to actually apply the migration after review.
# When "no", manifests are only exported for review.
APPLY_MIGRATION="${APPLY_MIGRATION:-no}"

# Directory to store exported manifests for review.
EXPORT_DIR="${EXPORT_DIR:-./default-namespace-migration}"

# --------- FUNCTIONS ---------

require_kubectl() {
  if ! command -v kubectl >/dev/null 2>&1; then
    echo "ERROR: kubectl not found in PATH. Install/configure kubectl and re-run." >&2
    exit 1
  fi
}

validate_target_namespace() {
  if [[ -z "${TARGET_NAMESPACE}" ]]; then
    echo "ERROR: TARGET_NAMESPACE is empty. Set TARGET_NAMESPACE and re-run." >&2
    exit 1
  fi
  if [[ "${TARGET_NAMESPACE}" == "default" ]] || [[ "${TARGET_NAMESPACE}" == "kube-system" ]]; then
    echo "ERROR: TARGET_NAMESPACE must not be 'default' or 'kube-system'." >&2
    exit 1
  fi
}

ensure_target_namespace_exists() {
  if ! kubectl get namespace "${TARGET_NAMESPACE}" >/dev/null 2>&1; then
    echo "INFO: Creating namespace '${TARGET_NAMESPACE}'..."
    kubectl create namespace "${TARGET_NAMESPACE}"
  else
    echo "INFO: Namespace '${TARGET_NAMESPACE}' already exists."
  fi
}

export_default_namespace_objects() {
  mkdir -p "${EXPORT_DIR}"

  echo "INFO: Exporting non-kubernetes-service objects from 'default' namespace..."
  # Get all namespaced API resources that support 'list' and 'get'
  mapfile -t resources < <(
    kubectl api-resources --namespaced=true -o name 2>/dev/null | sort -u
  )

  for res in "${resources[@]}"; do
    # Skip events and ephemeral/system-like resources that usually shouldn't be migrated
    case "${res}" in
      events.events.k8s.io|events|leases.coordination.k8s.io)
        continue
        ;;
    esac

    # List objects in default namespace, excluding the built-in 'kubernetes' service
    objects=$(kubectl get "${res}" -n default --no-headers 2>/dev/null | awk '{print $1}' | grep -v '^kubernetes$' || true)
    if [[ -z "${objects}" ]]; then
      continue
    fi

    for obj in ${objects}; do
      # Export manifest without cluster-specific fields (server-side apply friendly)
      echo "INFO: Exporting ${res}/${obj}..."
      kubectl get "${res}" "${obj}" -n default -o yaml \
        | sed '/^\s*resourceVersion:/d' \
        | sed '/^\s*uid:/d' \
        | sed '/^\s*creationTimestamp:/d' \
        | sed '/^\s*managedFields:/,/^\s*[^ ]/d' \
        > "${EXPORT_DIR}/${res}__${obj}.yaml"
    done
  done

  echo "INFO: Exported manifests are in: ${EXPORT_DIR}"
}

update_manifests_namespace() {
  echo "INFO: Updating exported manifests to use namespace '${TARGET_NAMESPACE}'..."
  for file in "${EXPORT_DIR}"/*.yaml; do
    [[ -e "$file" ]] || continue
    # Ensure metadata.namespace is set to TARGET_NAMESPACE
    if grep -q '^\s*namespace:\s*default\s*$' "$file"; then
      sed -i "s/^\(\s*namespace:\s*\)default\s*$/\1${TARGET_NAMESPACE}/" "$file"
    elif ! grep -q '^\s*namespace:\s*' "$file"; then
      # Insert namespace under metadata if missing
      awk -v ns="${TARGET_NAMESPACE}" '
        /^metadata:\s*$/ && !seen {
          print $0;
          print "  namespace: " ns;
          seen=1;
          next
        }
        {print $0}
      ' "$file" > "${file}.tmp" && mv "${file}.tmp" "$file"
    fi
  done
}

apply_migration_manifests() {
  echo "INFO: Applying manifests into '${TARGET_NAMESPACE}'..."
  kubectl apply -n "${TARGET_NAMESPACE}" -f "${EXPORT_DIR}"
}

delete_objects_from_default() {
  echo "INFO: Deleting migrated objects from 'default' namespace..."

  # Derive original resource/kind and name from filenames
  for file in "${EXPORT_DIR}"/*.yaml; do
    [[ -e "$file" ]] || continue
    res=$(basename "$file" | sed 's/\.yaml$//' | awk -F'__' '{print $1}')
    name=$(basename "$file" | sed 's/\.yaml$//' | awk -F'__' '{print $2}')

    if [[ -n "${res}" && -n "${name}" ]]; then
      # Ensure we don't delete the built-in service even if present
      if [[ "${res}" == "services" || "${res}" == "service" ]]; then
        if [[ "${name}" == "kubernetes" ]]; then
          continue
        fi
      fi
      echo "INFO: Deleting ${res}/${name} from 'default'..."
      kubectl delete "${res}" "${name}" -n default --ignore-not-found
    fi
  done
}

verify_default_namespace_unused() {
  echo "INFO: Verifying that the default namespace is unused (except for the 'kubernetes' service)..."
  output=$(kubectl get all -n default --no-headers 2>/dev/null | grep -v '^service\s\+kubernetes\s' || true)
  if [ -z "$output" ]; then
    echo "DEFAULT_NAMESPACE_UNUSED"
  else
    echo "DEFAULT_NAMESPACE_IN_USE"
    echo "Remaining objects in 'default' namespace:"
    echo "${output}"
  fi
}

# --------- MAIN ---------

require_kubectl
validate_target_namespace
ensure_target_namespace_exists
export_default_namespace_objects
update_manifests_namespace

if [[ "${APPLY_MIGRATION}" == "yes" ]]; then
  echo "WARNING: You have set APPLY_MIGRATION=yes."
  echo "         This will:"
  echo "           - apply exported manifests into '${TARGET_NAMESPACE}'"
  echo "           - delete the corresponding objects from 'default'"
  read -r -p "Type 'migrate' to proceed, or anything else to abort: " confirm
  if [[ "${confirm}" == "migrate" ]]; then
    apply_migration_manifests
    delete_objects_from_default
  else
    echo "INFO: Migration aborted by user; manifests are available in ${EXPORT_DIR} for manual review."
  fi
else
  echo "INFO: APPLY_MIGRATION is 'no'."
  echo "      Review manifests in ${EXPORT_DIR}, then re-run with APPLY_MIGRATION=yes to perform migration."
fi

verify_default_namespace_unused