4.6.3 default-namespace 检查出现假阳性失败: 正则表达式不匹配 kubectl 的 service/Kubernetes 输出 (aks-1.7/1.8, gke-1.8.0/1.9.0)

Overview

Check 4.6.3 "The default namespace should not be used (Automated)" reports FAIL on a cluster whose default namespace contains nothing but the built-in Kubernetes Service. The audit tries to exclude that Service with a regex written for the legacy two-column kubectl layout (service Kubernetes), but kubectl get all prints rows in resource/name form (service Kubernetes), so the exclusion never matches and the built-in Service itself is counted as "usage".