NamespaceHound: protecting multi-tenant K8s clusters

This report explains Kubernetes multi-tenancy and the challenges of enforcing namespace isolation, introducing NamespaceHound—a CLI tool that analyzes clusters to detect potential cross-namespace violations, anonymous access risks, and lateral movement paths. It highlights sample findings (e.g., RBAC secrets access and cross-namespace workload creation), operational requirements, and integrates its results into the Wiz portal for namespace forensics and blast radius analysis. The document extends the PEACH framework to Kubernetes and outlines hardening practices across privilege, encryption, authentication, and connectivity, along with recommendations for network policies, storage isolation, and RBAC least privilege.