This repository contains a set of Multi-Tenancy Benchmarks published by the Multi-Tenancy Working Group. The benchmarks can be used to validate if a Kubernetes cluster is properly configured for multi-tenancy. An e2e test tool that can be used to validate if your clusters are multi-tenant, is also provided.
The multi-tenancy benchmarks are meant to be used as guidelines and best practices and as part of a comprehensive security strategy. In other words they are not a substitute for a other security benchmarks, guidelines, or best practices.
For background, see: Multi-Tenancy Benchmarks Proposal.
The multi-tenancy benchmarks are in development and not ready for usage.
- Multi-Tenancy Definitions
- Benchmark Types
- Benchmark Categories
- Running Validation Tests
- Contributing
see profile definitions and categories.
| ID | Benchmark | Test |
|---|---|---|
| MTB-PL1-CC-CPI-1 | Block access to cluster resources | src |
| MTB-PL1-CC-TI-2 | Block access to other tenant resources | |
| MTB-PL1-CC-FNS-1 | Configure namespace resource quotas | src |
| MTB-PL1-CC-TI-1 | Block modification of resource quotas |
| ID | Benchmark | Test |
|---|---|---|
| MTB-PL1-BC-CPI-2 | Block modification of multi-tenancy resources | |
| MTB-PL1-BC-CPI-3 | Block add capabilities | |
| MTB-PL1-BC-CPI-4 | Require running as non-root user | |
| MTB-PL1-BC-CPI-5 | Block privileged containers | |
| MTB-PL1-BC-CPI-6 | Block privilege escalation | |
| MTB-PL1-BC-NI-1 | Default deny network connections across tenants | |
| MTB-PL1-BC-HI-1 | Block use of bind mounts | |
| MTB-PL1-BC-HI-2 | Block use of NodePort services | |
| MTB-PL1-BC-HI-3 | Block use of host networking and ports | |
| MTB-PL1-BC-HI-4 | Block use of host PID | |
| MTB-PL1-BC-HI-5 | Block use of host IPC |