Namespace

RESOURCE

A virtual cluster within Kubernetes used to isolate and organize resources

Kind
Namespace
Type
RESOURCE
Referenced by
30 topics

A Namespace is a way to divide a single Kubernetes cluster into logical groups. Resources like Pods, Services, and ConfigMaps live inside a namespace, and names only need to be unique within one. This makes it easier to organize workloads by team, environment, or application without running separate clusters.

Kubernetes ships with a few built-in namespaces. default is where resources land if you don’t specify one. kube-system is reserved for cluster components like the API server and scheduler. kube-public holds publicly readable data, and kube-node-lease is used for node heartbeats.

Most resource types are namespace-scoped, meaning they exist within a namespace and are invisible from outside it. A few types like Nodes and ClusterRoles are cluster-scoped and exist globally across all namespaces.

Attacked and defended in

30
OFFENSIVE Abusing Kubernetes API Server Proxy LATERAL MOVEMENT OFFENSIVE Active Internal Network Reconnaissance RECONNAISSANCE OFFENSIVE Cluster Reconnaissance via Prometheus RECONNAISSANCE OFFENSIVE Compromising ArgoCD via Application Sync PRIVILEGE ESCALATION OFFENSIVE Compromising etcd via Pod Creation CREDENTIAL ACCESS OFFENSIVE Data Exfiltration via Kubernetes Events EXFILTRATION DEFENSIVE Detecting API Server Proxy Abuse DEFENSIVE Detecting Argo Workflows Abuse via Audit Logs DEFENSIVE Detecting Data Exfiltration via Kubernetes Events DEFENSIVE Detecting Impersonation Abuse DEFENSIVE Detecting kubectl debug Activity via Audit Logs DEFENSIVE Detecting Orphan Pod Masquerading via Audit Logs DEFENSIVE Detecting Permission Enumeration via Audit Logs DEFENSIVE Disable Automatic Mounting of Default Service Account Tokens DEFENSIVE Enforcing Read-Only Container Filesystems DEFENSIVE Hiding Services from Enumeration OFFENSIVE Internal Cluster Discovery RECONNAISSANCE OFFENSIVE Kubernetes Impersonation PRIVILEGE ESCALATION OFFENSIVE Passive Secret Discovery via kube-state-metrics RECONNAISSANCE OFFENSIVE Persistence via Unbound Service Account Tokens PERSISTENCE OFFENSIVE Privilege Escalation via serviceaccounts/token Permission PRIVILEGE ESCALATION DEFENSIVE Restricting Prometheus Endpoint Access OFFENSIVE Rogue Static Pod Deployment PERSISTENCE OFFENSIVE Secret Exfiltration via ApplicationSet Generators CREDENTIAL ACCESS DEFENSIVE Securing ArgoCD Application Access OFFENSIVE ServiceAccount Token Theft CREDENTIAL ACCESS OFFENSIVE Weaponizing Argo Workflows PRIVILEGE ESCALATION OFFENSIVE Weaponizing ArgoCD Application PRIVILEGE ESCALATION OFFENSIVE Weaponizing kubectl debug PRIVILEGE ESCALATION OFFENSIVE Weaponizing Pod Creation Access PRIVILEGE ESCALATION