Create Administrative Boundaries Between Resources Using Namespaces

# 1) List all namespaces and their age
# Run on: any machine with kubectl access
kubectl get namespaces --show-labels

# 2) See which namespaces actually contain workloads
kubectl get all --all-namespaces

# 3) Summarize workload kinds per namespace
kubectl get pods,deploy,sts,ds,job,cronjob -A \
  -o custom-columns='NAMESPACE:.metadata.namespace,KIND:.kind,NAME:.metadata.name' \
  | sort -u

# 4) Inspect labels/annotations on a specific busy namespace (example: default)
kubectl describe namespace default

# 5) Identify which namespaces are used for user workloads vs system
kubectl get ns \
  -o custom-columns='NAME:.metadata.name,AGE:.metadata.creationTimestamp,LABELS:.metadata.labels'

# 6) For one or two key namespaces, list owners via labels
# Replace <namespace> as needed
kubectl get deploy,sts,ds,svc,ingress -n <namespace> \
  -o custom-columns='KIND:.kind,NAME:.metadata.name,TEAM:.metadata.labels.team,APP:.metadata.labels.app,ENV:.metadata.labels.env'

#!/usr/bin/env bash
# Report namespace usage and potential issues for CIS GKE 4.6.1
# Run on: any machine with kubectl access and appropriate RBAC

set -euo pipefail

echo "=== Cluster-wide Namespace Overview ==="
kubectl get namespaces -o wide

echo
echo "=== Namespace Annotations & Labels (for admin boundaries) ==="
kubectl get ns -o json \
  | jq -r '
    .items[]
    | {
        name: .metadata.name,
        labels: .metadata.labels,
        annotations: .metadata.annotations
      }' \
  | jq .

echo
echo "=== Workloads per Namespace (pods, deployments, statefulsets, daemonsets, jobs, cronjobs) ==="
# Summarize main workload objects per namespace
kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' \
  | while read -r ns; do
      echo "--- Namespace: ${ns} ---"
      kubectl get pods,deployments,statefulsets,daemonsets,jobs,cronjobs -n "${ns}" --ignore-not-found
      echo
    done

echo
echo "=== Namespaces with Mixed 'types' of Workloads (heuristic) ==="
echo "Note: This heuristic flags namespaces that mix system, infra, and app workloads by label patterns."
echo "You must manually review and decide if separation is required."

# Heuristic: classify workloads by label keys commonly used to denote ownership/type
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | {
        ns: .metadata.namespace,
        name: .metadata.name,
        labels: (.metadata.labels // {}),
        owner: (
          if .metadata.labels["app.kubernetes.io/part-of"] then "app"
          elif .metadata.labels["k8s-app"] then "system-or-infra"
          elif .metadata.labels["app"] then "app"
          else "unknown"
          end
        )
      }' \
  | jq -s '
    group_by(.ns)
    | map({
        namespace: .[0].ns,
        counts: (group_by(.owner) | map({(.[0].owner): length}) | add)
      })' \
  | jq -r '
    .[]
    | select((.counts["app"] != null and .counts["system-or-infra"] != null) or (.counts["unknown"] != null and (.counts["app"] != null or .counts["system-or-infra"] != null)))
    '

echo
echo "=== Namespaces with Both System and Application-Looking Objects (by name pattern) ==="
echo "Patterns used: kube-*, istio-*, linkerd, logging, monitoring, prometheus, envoy, ingress"
echo "Review these for possible separation of system/infra from application workloads."

patterns='kube-|istio-|linkerd|logging|monitoring|prometheus|envoy|ingress'

kubectl get pods --all-namespaces -o wide \
  | awk 'NR==1 {next} {print $1, $2}' \
  | while read -r ns pod; do
      if [[ "${pod}" =~ ${patterns} ]]; then
        echo "${ns} SYSTEM_OR_INFRA_POD ${pod}"
      else
        echo "${ns} APP_OR_OTHER_POD ${pod}"
      fi
    done \
  | awk '
      {
        ns=$1; type=$2
        has[ns][type]=1
      }
      END {
        for (n in has) {
          if (has[n]["SYSTEM_OR_INFRA_POD"] && has[n]["APP_OR_OTHER_POD"]) {
            print n ": has both system/infra-looking and app-looking pods"
          }
        }
      }' \
  | sort

echo
echo "=== Namespaces with No Clear Labeling for Ownership/Boundary (candidates for review) ==="
kubectl get ns -o json \
  | jq -r '
    .items[]
    | {
        name: .metadata.name,
        labels: .metadata.labels
      }
    | select(.name != "kube-system" and .name != "kube-public" and .name != "kube-node-lease" and .name != "default")
    | select(
        (.labels["team"] == null)
        and (.labels["owner"] == null)
        and (.labels["app.kubernetes.io/part-of"] == null)
        and (.labels["environment"] == null)
      )
    | .name' \
  | sort

echo
echo "=== Objects in the 'default' Namespace (strong candidates for re-namespacing) ==="
echo "These commonly indicate missing administrative boundaries."
kubectl get all -n default --show-kind --ignore-not-found

echo
echo "=== Summary & Interpretation Guidance ==="
cat <<'EOF'
Review guidance (CIS GKE 4.6.1 - MANUAL):

Potential problems you should investigate:

1) Heavy use of the 'default' namespace:
   - If many applications, services, or jobs are in 'default', they likely lack
     clear administrative boundaries. Consider moving them into dedicated
     namespaces per app, team, environment, or trust level.

2) Namespaces that mix system/infra and application workloads:
   - The sections "Namespaces with Mixed 'types' of Workloads" and
     "Namespaces with Both System and Application-Looking Objects" list
     namespaces that appear to host both:
       * cluster/system/infra components (e.g., kube-*, istio-*, logging/monitoring)
       * regular application pods
   - Consider separating system/infra components from business applications
     into distinct namespaces.

3) Namespaces with no ownership/boundary labels:
   - The "Namespaces with No Clear Labeling" section lists namespaces
     that lack common labels to denote owner, team, or environment.
   - While not a hard failure, unclear ownership often correlates with
     weak administrative boundaries.

4) General organization:
   - Review whether you have a namespace strategy (e.g. by team, by app,
     by environment: dev/stage/prod, by sensitivity).
   - For each multi-tenant/shared cluster, ensure tenants do not share
     namespaces unless intentionally designed.

This script only reports; it does NOT change any resources.
You must decide, per finding, whether to create new namespaces and
move workloads, following your operational and security requirements.
EOF