auditing-namespace-as-tenant-boundarylisted

# Auditing the namespace as a tenant boundary: what a namespace does not isolate A namespace is a name-scoping and policy-attachment unit, not a security sandbox, yet multi-tenant clusters routinely hand each tenant a namespace and assume it contains them. It does not, on its own. Nodes are shared, so a tenant that can influence scheduling or escape a container reaches another tenant's pods on the same node. Cluster-scoped resources, custom resource definitions, node objects, persistent volumes, and cluster roles sit outside every namespace and are visible or reachable across them. RBAC that grants a verb at cluster scope, or on another namespace, punches straight through the boundary. Without network policy, pods cross namespaces freely. And the shared cluster services every tenant depends on, DNS, ingress, admission, storage classes, see or serve all tenants at once. The audit question is not whether tenants have separate namespaces but whether the namespace actually stops one from affecting or observing another. You audit this by testing each isolation the boundary is assumed to provide. ## When to use - A namespace is the unit of tenant separation and is assumed to isolate one tenant from another. - Tenants share nodes, cluster-scoped resources, and cluster services (DNS, ingress, admission, storage). - RBAC, network policy, or resource quotas may not fully confine a tenant to its own namespace. ## Scope check Audit tenant isolation only on clusters you own or are au