Multi-Tenancy Benchmarks (MTB) are guidelines for multi-tenant configuration of Kubernetes clusters.
The kubectl plugin kubectl-mtb can be used to validate if a Kubernetes cluster is properly configured for multi-tenancy.
Multi-Tenancy Benchmarks are meant to be used as part of a comprehensive security strategy. They are not a substitute for other security best practices and do not guarantee security.
For background, see: Multi-Tenancy Benchmarks Proposal.
The multi-tenancy benchmarks are in development and not ready for usage.
- Multi-tenancy Definitions
- Benchmark Profiles
- Benchmark Types
- Benchmark Categories
- Running benchmark validation tests with kubectl-mtb
- Contributing to the benchmarks
The following tests are currently defined (tests marked pending are planned for implementation):
- Block access to cluster resources
- Block access to Multitenant Resources
- Block access to other tenant resources (pending #1197)
- Block add capabilities
- Require image pull
always - Require run as non-root user
- Block privileged containers
- Block privilege escalation
- Configure namespace resource quotas
- Configure namespace object limits
- Block use of host path volumes
- Block use of NodePort services
- Block use of host networking and ports
- Block use of host PID
- Block use of host IPC
- Block modification of resource quotas
- Require PersistentVolumeClaim for storage (pending #1198)
- Require PV reclaim policy of
delete(pending #1199) - Block use of existing PVs (pending #1200)
- Block network access across tenant namespaces (pending #1201)
- Allow self-service management of Network Policies
- Allow self-service management of Roles (pending #1202)
- Allow self-service management of Roles Bindings (pending #1203)