1"use strict";(self.webpackChunkcloudanix_dotcom_docs_temp=self.webpackChunkcloudanix_dotcom_docs_temp||[]).push([["111309"],{979054(e,n,s){s.r(n),s.d(n,{metadata:()=>a,default:()=>p,frontMatter:()=>r,contentTitle:()=>l,toc:()=>c,assets:()=>o});var a=JSON.parse('{"id":"gcp/audit/gcpkubernetesmisconfig/rules/gcp_namespaces_administrative_boundaries","title":"Create Administrative Boundaries Between Resources Using","description":"Namespaces provide administrative and security boundaries for segregating cluster resources. Objects should be organized into dedicated namespaces rather\u2026","source":"@site/docs/gcp/audit/gcpkubernetesmisconfig/rules/gcp_namespaces_administrative_boundaries.mdx","sourceDirName":"gcp/audit/gcpkubernetesmisconfig/rules","slug":"/gcp/audit/gcpkubernetesmisconfig/rules/gcp_namespaces_administrative_boundaries","permalink":"/docs/gcp/audit/gcpkubernetesmisconfig/rules/gcp_namespaces_administrative_boundaries","draft":false,"unlisted":false,"editUrl":"https://github.com/Cloudanix/cloudanix-dotcom-docs/edit/main/docs/gcp/audit/gcpkubernetesmisconfig/rules/gcp_namespaces_administrative_boundaries.mdx","tags":[],"version":"current","frontMatter":{"title":"Create Administrative Boundaries Between Resources Using","sidebar_label":"Create Administrative Boundaries Between Resources Using Namespaces","description":"Namespaces provide administrative and security boundaries for segregating cluster resources. Objects should be organized into dedicated namespaces rather\u2026"},"sidebar":"docsSidebar","previous":{"title":"Tenant Namespaces Should Have A ResourceQuota","permalink":"/docs/gcp/audit/gcpkubernetesmisconfig/rules/gcp_namespace_resourcequota"},"next":{"title":"Ensure All Namespaces Have Network Policies Defined","permalink":"/docs/gcp/audit/gcpkubernetesmisconfig/rules/gcp_namespaces_have_network_policies"}}'),i=s(474848),t=s(28453);let r={title:"Create Administrative Boundaries Between Resources Using",sidebar_label:"Create Administrative Boundaries Between Resources Using Namespaces",description:"Namespaces provide administrative and security boundaries for segregating cluster resources. Objects should be organized into dedicated namespaces rather\u2026"},l,o={},c=[{value:"More Info:",id:"more-info",level:3},{value:"Risk Level",id:"risk-level",level:3},{value:"Address",id:"address",level:3},{value:"Compliance Standards",id:"compliance-standards",level:3},{value:"Triage and Remediation",id:"triage-and-remediation",level:3},{value:"Remediation",id:"remediation",level:3}];function d(e){let n={br:"br",code:"code",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,t.R)(),...e.components},{Accordion:s,AccordionGroup:a,Tab:r,Tabs:l}=n;return s||m("Accordion",!0),a||m("AccordionGroup",!0),r||m("Tab",!0),l||m("Tabs",!0),(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h3,{id:"more-info",children:"More Info:"}),"\n",(0,i.jsx)(n.p,{children:"Namespaces provide administrative and security boundaries for segregating cluster resources. Objects should be organized into dedicated namespaces rather than sharing a single namespace."}),"\n",(0,i.jsx)(n.h3,{id:"risk-level",children:"Risk Level"}),"\n",(0,i.jsx)(n.p,{children:"Low"}),"\n",(0,i.jsx)(n.h3,{id:"address",children:"Address"}),"\n",(0,i.jsx)(n.p,{children:"Security"}),"\n",(0,i.jsx)(n.h3,{id:"compliance-standards",children:"Compliance Standards"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"CIS GKE"}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"triage-and-remediation",children:"Triage and Remediation"}),"\n",(0,i.jsx)(l,{children:(0,i.jsxs)(r,{title:"Remediation",children:[(0,i.jsx)(n.h3,{id:"remediation",children:"Remediation"}),(0,i.jsxs)(a,{children:[(0,i.jsx)(s,{title:"Manual Steps",defaultOpen:"true",children:(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Inventory current namespaces and workloads"}),(0,i.jsx)(n.br,{}),"\n","Run on any machine with kubectl access:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"kubectl get namespaces\nkubectl get all --all-namespaces\n"})}),"\n",(0,i.jsxs)(n.p,{children:["Review which namespaces exist, which are system/managed (e.g., ",(0,i.jsx)(n.code,{children:"kube-system"}),", ",(0,i.jsx)(n.code,{children:"gke-system"}),", ",(0,i.jsx)(n.code,{children:"istio-system"}),", ",(0,i.jsx)(n.code,{children:"gatekeeper-system"}),"), and where your application workloads currently run."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Identify workloads running in inappropriate or shared namespaces"}),(0,i.jsx)(n.br,{}),"\n","Focus on ",(0,i.jsx)(n.code,{children:"default"}),", ",(0,i.jsx)(n.code,{children:"kube-system"}),", and any \u201Ccatch\u2011all\u201D namespaces:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"kubectl get all -n default\nkubectl get all -n kube-system\n"})}),"\n",(0,i.jsxs)(n.p,{children:["Decide which applications, environments (dev/test/prod), or teams are mi
1xed together and should be separated (e.g., multiple apps sharing ",(0,i.jsx)(n.code,{children:"default"}),", non-system apps in ",(0,i.jsx)(n.code,{children:"kube-system"}),")."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Design a namespace structure aligned to admin and security boundaries"}),(0,i.jsx)(n.br,{}),"\n","On a planning machine (no commands):"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Define namespaces per application, per environment, or per tenant/team (e.g., ",(0,i.jsx)(n.code,{children:"app1-prod"}),", ",(0,i.jsx)(n.code,{children:"app1-dev"}),", ",(0,i.jsx)(n.code,{children:"payments-prod"}),", ",(0,i.jsx)(n.code,{children:"analytics-dev"}),")."]}),"\n",(0,i.jsxs)(n.li,{children:["Decide which namespaces require stronger controls (e.g., separate namespace for internet-facing workloads, sensitive data, or admin tooling).",(0,i.jsx)(n.br,{}),"\n","Document the desired namespace layout and which workloads should live where."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Create or update namespace definitions"}),(0,i.jsx)(n.br,{}),"\n","Run on any machine with kubectl access:"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["To create missing namespaces:","\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"kubectl create namespace app1-prod\nkubectl create namespace app1-dev\n"})}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["Or define them declaratively in a manifest file (example):","\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: v1\nkind: Namespace\nmetadata:\n name: app1-prod\n---\napiVersion: v1\nkind: Namespace\nmetadata:\n name: app1-dev\n"})}),"\n","Apply with:","\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"kubectl apply -f namespaces.yaml\n"})}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Relocate workloads into the appropriate namespaces"}),(0,i.jsx)(n.br,{}),"\n","For each workload that should move (Deployments, Services, Jobs, etc.):"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Export its manifest and edit the ",(0,i.jsx)(n.code,{children:"metadata.namespace"})," (and any namespace-qualified references such as ConfigMaps, Secrets, ServiceAccounts):","\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"kubectl get deploy my-app -n default -o yaml > my-app.yaml\n"})}),"\n","Edit ",(0,i.jsx)(n.code,{children:"my-app.yaml"})," to set:","\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"metadata:\n namespace: app1-prod\n"})}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["Delete the old object and recreate it in the new namespace (ensure you understand the downtime impact):","\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"kubectl delete deploy my-app -n default\nkubectl apply -f my-app.yaml\n"})}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:"Repeat for Services, ConfigMaps, Secrets, etc., ensuring all required dependencies exist in the target namespace."}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Verify namespace boundaries are in place"}),(0,i.jsx)(n.br,{}),"\n","Run on any machine with kubectl access:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"kubectl get namespaces\nkubectl get all -n app1-prod\nkubectl get all -n app1-dev\nkubectl get all -n default\n"})}),"\n",(0,i.jsx)(n.p,{children:"Confirm that:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Application workloads are no longer concentrated in ",(0,i.jsx)(n.code,{children:"default"})," or mixed with system components."]}),"\n",(0,i.jsx)(n.li,{children:"Workloads are organized according to the designed boundaries (per app/environment/team) and system namespaces contain only system components."}),"\n"]}),"\n"]}),"\n"]})}),(0,i.jsxs)(s,{title:"Using kubectl",children:[(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"# 1) List all namespaces and their age\n# Run on: any machine with kubectl access\nkubectl get namespaces --show-labels\n"})}),(0,i.jsx)(n.p,{children:"Review guidance:"}),(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Potential problems if:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Almost all workloads are in ",(0,i.jsx)(n.code,{children:"default"}),", ",(0,i.jsx)(n.code,{children:"kube-system"}),", or ",(0,i.jsx)(n.code,{children:"kube-public"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Many namespaces exist but have no clear purpose or labels (e.g., missing ",(0,i.jsx)(n.code,{children:"env="}),", ",(0,i.jsx)(n.code,{children:"team="}),", ",(0,i.jsx)(n.code,{children:"app="})," style labels)."]}),"\n",(0,i.jsxs)(n.li,{children:["System namespaces (",(0,i.jsx)(n.code,{children:"kube-system"}),", ",(0,i.jsx)(n.code,{children:"kube-public"}),", ",(0,i.jsx)(n.code,{children:"kube-node-lease"}),", ",(0,i.jsx)(n.code,{children:"gke-*"}),") are used for custom application workloads."]}),"\n"]}),"\n"]}),"\n"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"# 2) See which namespaces actually contain workloads\nkubectl get all --all-namespaces\n"})}),(0,i.jsx)(n.p,{children:"Review guidance:"}),(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Potential problems if:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Most ",(0,i.jsx)(n.code,{children:"Deployment"}),", ",(0,i.jsx)(n.code,{children:"StatefulSet"}),", ",(0,i.jsx)(n.code,{children:"DaemonSet"}),", ",(0,i.jsx)(n.code,{children:"Job"}),", or ",(0,i.jsx)(n.code,{children:"Pod"})," objects are in a single shared namespace like ",(0,i.jsx)(n.code,{children:"default"}),"."]}),"\n",(0,i.jsx)(n.li,{children:"Unrelated applications or teams share the same namespace with no separation."}),"\n"]}),"\n"]}),"\n"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"# 3) Summarize workload kinds per namespace\nkubectl get pods,deploy,sts,ds,job,cronjob -A \\\n -o custom-columns='NAMESPACE:.metadata.namespace,KIND:.kind,NAME:.metadata.name' \\\n | sort -u\n"})}),(0,i.jsx)(n.p,{children:"Review guidance:"}),(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Potential problems if:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"You see many unrelated applications (by name) co-located in the same namespace."}),"\n",(0,i.jsx)(n.li,{children:"There is no visible pattern (e.g., per-team, per-environment, or per-application grouping)."}),"\n"]}),"\n"]}),"\n"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"# 4) Inspect labels/annotations on a specific busy namespace (example: default)\nkubectl describe namespace default\n"})}),(0,i.jsx)(n.p,{children:"Review guidance:"}),(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Potential problems if:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"The namespace lacks labels that indicate ownership, environment, or purpose."}),"\n",(0,i.jsx)(n.li,{children:"The namespace mixes \u201Cshared\u201D or \u201Cmisc\u201D workloads with no clear boundary."}),"\n"]}),"\n"]}),"\n"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"# 5) Identify which namespaces are used for user workloads vs system\
1nkubectl get ns \\\n -o custom-columns='NAME:.metadata.name,AGE:.metadata.creationTimestamp,LABELS:.metadata.labels'\n"})}),(0,i.jsx)(n.p,{children:"Review guidance:"}),(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Potential problems if:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["User workloads appear in system namespaces (names beginning with ",(0,i.jsx)(n.code,{children:"kube-"})," or ",(0,i.jsx)(n.code,{children:"gke-"}),")."]}),"\n",(0,i.jsx)(n.li,{children:"There is no clear distinction between system and application namespaces."}),"\n"]}),"\n"]}),"\n"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"# 6) For one or two key namespaces, list owners via labels\n# Replace <namespace> as needed\nkubectl get deploy,sts,ds,svc,ingress -n <namespace> \\\n -o custom-columns='KIND:.kind,NAME:.metadata.name,TEAM:.metadata.labels.team,APP:.metadata.labels.app,ENV:.metadata.labels.env'\n"})}),(0,i.jsx)(n.p,{children:"Review guidance:"}),(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Potential problems if:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Multiple teams (",(0,i.jsx)(n.code,{children:"TEAM"})," label) or environments (",(0,i.jsx)(n.code,{children:"ENV"})," label) share the same namespace."]}),"\n",(0,i.jsx)(n.li,{children:"No labels are present to show who owns resources or what boundary they belong to."}),"\n"]}),"\n"]}),"\n"]}),(0,i.jsx)(n.p,{children:"Interpreting issues for this control:"}),(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["You likely fail the intent of CISGKE 4.6.1 if:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Most or all application workloads run in ",(0,i.jsx)(n.code,{children:"default"}),"."]}),"\n",(0,i.jsx)(n.li,{children:"Different applications, teams, or environments are not separated into distinct namespaces."}),"\n",(0,i.jsx)(n.li,{children:"System and application workloads are mixed in the same namespaces."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["A healthy pattern usually shows:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Dedicated namespaces per application, team, or environment."}),"\n",(0,i.jsx)(n.li,{children:"System namespaces used only for system components."}),"\n"]}),"\n"]}),"\n"]})]}),(0,i.jsxs)(s,{title:"Automation",children:[(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:'#!/usr/bin/env bash\n# Report namespace usage and potential issues for CIS GKE 4.6.1\n# Run on: any machine with kubectl access and appropriate RBAC\n\nset -euo pipefail\n\necho "=== Cluster-wide Namespace Overview ==="\nkubectl get namespaces -o wide\n\necho\necho "=== Namespace Annotations & Labels (for admin boundaries) ==="\nkubectl get ns -o json \\\n | jq -r \'\n .items[]\n | {\n name: .metadata.name,\n labels: .metadata.labels,\n annotations: .metadata.annotations\n }\' \\\n | jq .\n\necho\necho "=== Workloads per Namespace (pods, deployments, statefulsets, daemonsets, jobs, cronjobs) ==="\n# Summarize main workload objects per namespace\nkubectl get ns -o jsonpath=\'{range .items[*]}{.metadata.name}{"\\n"}{end}\' \\\n | while read -r ns; do\n echo "--- Namespace: ${ns} ---"\n kubectl get pods,deployments,statefulsets,daemonsets,jobs,cronjobs -n "${ns}" --ignore-not-found\n echo\n done\n\necho\necho "=== Namespaces with Mixed \'types\' of Workloads (heuristic) ==="\necho "Note: This heuristic flags namespaces that mix system, infra, and app workloads by label patterns."\necho "You must manually review and decide if separation is required."\n\n# Heuristic: classify workloads by label keys commonly used to denote ownership/type\nkubectl get pods --all-namespaces -o json \\\n | jq -r \'\n .items[]\n | {\n ns: .metadata.namespace,\n name: .metadata.name,\n labels: (.metadata.labels // {}),\n owner: (\n if .metadata.labels["app.kubernetes.io/part-of"] then "app"\n elif .metadata.labels["k8s-app"] then "system-or-infra"\n elif .metadata.labels["app"] then "a
1pp"\n else "unknown"\n end\n )\n }\' \\\n | jq -s \'\n group_by(.ns)\n | map({\n namespace: .[0].ns,\n counts: (group_by(.owner) | map({(.[0].owner): length}) | add)\n })\' \\\n | jq -r \'\n .[]\n | select((.counts["app"] != null and .counts["system-or-infra"] != null) or (.counts["unknown"] != null and (.counts["app"] != null or .counts["system-or-infra"] != null)))\n \'\n\necho\necho "=== Namespaces with Both System and Application-Looking Objects (by name pattern) ==="\necho "Patterns used: kube-*, istio-*, linkerd, logging, monitoring, prometheus, envoy, ingress"\necho "Review these for possible separation of system/infra from application workloads."\n\npatterns=\'kube-|istio-|linkerd|logging|monitoring|prometheus|envoy|ingress\'\n\nkubectl get pods --all-namespaces -o wide \\\n | awk \'NR==1 {next} {print $1, $2}\' \\\n | while read -r ns pod; do\n if [[ "${pod}" =~ ${patterns} ]]; then\n echo "${ns} SYSTEM_OR_INFRA_POD ${pod}"\n else\n echo "${ns} APP_OR_OTHER_POD ${pod}"\n fi\n done \\\n | awk \'\n {\n ns=$1; type=$2\n has[ns][type]=1\n }\n END {\n for (n in has) {\n if (has[n]["SYSTEM_OR_INFRA_POD"] && has[n]["APP_OR_OTHER_POD"]) {\n print n ": has both system/infra-looking and app-looking pods"\n }\n }\n }\' \\\n | sort\n\necho\necho "=== Namespaces with No Clear Labeling for Ownership/Boundary (candidates for review) ==="\nkubectl get ns -o json \\\n | jq -r \'\n .items[]\n | {\n name: .metadata.name,\n labels: .metadata.labels\n }\n | select(.name != "kube-system" and .name != "kube-public" and .name != "kube-node-lease" and .name != "default")\n | select(\n (.labels["team"] == null)\n and (.labels["owner"] == null)\n and (.labels["app.kubernetes.io/part-of"] == null)\n and (.labels["environment"] == null)\n )\n | .name\' \\\n | sort\n\necho\necho "=== Objects in the \'default\' Namespace (strong candidates for re-namespacing) ==="\necho "These commonly indicate missing administrative boundaries."\nkubectl get all -n default --show-kind --ignore-not-found\n\necho\necho "=== Summary & Interpretation Guidance ==="\ncat <<\'EOF\'\nReview guidance (CIS GKE 4.6.1 - MANUAL):\n\nPotential problems you should investigate:\n\n1) Heavy use of the \'default\' namespace:\n - If many applications, services, or jobs are in \'default\', they likely lack\n clear administrative boundaries. Consider moving them into dedicated\n namespaces per app, team, environment, or trust level.\n\n2) Namespaces that mix system/infra and application workloads:\n - The sections "Namespaces with Mixed \'types\' of Workloads" and\n "Namespaces with Both System and Application-Looking Objects" list\n namespaces that appear to host both:\n * cluster/system/infra components (e.g., kube-*, istio-*, logging/monitoring)\n * regular application pods\n - Consider separating system/infra components from business applications\n into distinct namespaces.\n\n3) Namespaces with no ownership/boundary labels:\n - The "Namespaces with No Clear Labeling" section lists namespaces\n that lack common labels to denote owner, team, or environment.\n - While not a hard failure, unclear ownership often correlates with\n weak administrative boundaries.\n\n4) General organization:\n - Review whether you have a namespace strategy (e.g. by team, by app,\n by environment: dev/stage/prod, by sensitivity).\n - For each multi-tenant/shared cluster, ensure tenants do not share\n namespaces unless intentionally designed.\n\nThis script only reports; it does NOT change any resources.\nYou must decide, per finding, whether to create new namespaces and\nmove workloads, following your operational and security requirements.\nEOF\n'})}),(0,i.jsx)(n.p,{children:(0,i.jsx)(n.strong,{children:"What output indicates a problem (to be manually reviewed):"})}),(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Many user workloads listed under ",(0,i.jsx)(n.code,{children:"=== Objects in the 'default' Namespace ==="}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Namespaces listed under:","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.code,{children:"=== Namespaces with Mixed 'types' of Workloads (heuristic) ==="})}),"\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.code,{children:"=== Namespaces with Both System and Application-Looking Objects ==="})}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["Namespaces listed under ",(0,i.jsx)(n.code,{children:"=== Namespaces with No Clear Labeling for Ownership/Boundary ==="})," in a multi-tenant or complex environment."]}),"\n"]})]})]})]})})]})}function p(e={}){let{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}function m(e,n){throw Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},28453(e,n,s){s.d(n,{R:()=>r,x:()=>l});var a=s(296540);let i={},t=a.createContext(i);function r(e){let n=a.useContext(t);return a.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),a.createElement(t.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.