The service can separate workloads with security contexts, namespace boundaries, scheduling constraints, and runtime isolation settings.
Workload Isolation Controls
CCC.K8S.CP19
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH05 | Privileged Workloads Escape Isolation | Workloads granted privileged execution, host namespaces, host paths, or unrestricted Linux capabilities may bypass container isolation controls. Processes can then read node data, alter host state, or disrupt neighboring workloads, defeating the confidentiality, integrity, and availability boundaries of the shared worker infrastructure. |
| CCC.K8S.TH14 | Node Administrative Interfaces Expose Cluster Credentials | Node administrative interfaces reachable without sufficient authentication or network restriction may expose node metadata, workload credentials, logs, or execution functions. The node can then be queried or controlled outside the intended management path, allowing credential disclosure, unauthorized host changes, or disruption of scheduled workloads. |