<p>I am trying to create a K8s cluster in Azure AKS and when cluster is ready I can see couple of resources are created within the <code>default</code> namespace. Example secret, configmap:</p>
<p><a href="https://i.stack.imgur.com/6cIag.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/6cIag.png" alt="enter image description here" /></a></p>
<p>As a security recommendation NO k8s resources should be created under the <code>default</code> namespace so how to avoid it? It's created by default during cluster creation.</p>

<p><strong>I have found the same question asked</strong> <a href="https://learn.microsoft.com/en-us/answers/questions/522874/how-to-avoid-resource-creation-in-default-namespac.html" rel="nofollow noreferrer"><strong>here</strong></a>:</p>
<p>User <a href="https://learn.microsoft.com/answers/users/6678978/srbose-msft.html" rel="nofollow noreferrer">srbose-msft</a> (Microsoft employee) explained the principle of operation very well:</p>
<blockquote>
<p>In Kubernetes, a  <code>ServiceAccount controller</code>  manages the  <em>ServiceAccounts</em>  inside namespaces, and ensures a  <em>ServiceAccount</em>  named &quot;<strong>default</strong>&quot; exists in every active namespace.  [<a href="https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#serviceaccount-controller" rel="nofollow noreferrer">Reference</a>]</p>
<p><em>TokenController</em>  runs as part of  <code>kube-controller-manager</code>. It acts asynchronously. It watches  <em>ServiceAccount</em>  creation and creates a corresponding  <strong>ServiceAccount token Secret to allow API access</strong>.  [<a href="https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#token-controller" rel="nofollow noreferrer">Reference</a>] Thus, the  <em>secret</em>  for the  <strong>default</strong>  <em>ServiceAccount token</em>  is also created.</p>
<p>Trusting the custom CA from an application running as a pod usually requires some extra application configuration. You will need to add the CA certificate bundle to the list of CA certificates that the TLS client or server trusts. For example, you would do this with a golang TLS config by parsing the certificate chain and adding the parsed certificates to the  <code>RootCAs</code>  field in the  <code>tls.Config</code>  struct.</p>
<p>You can distribute the CA certificate as a  <em>ConfigMap</em>  that your pods have access to use.  [<a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/#trusting-tls-in-a-cluster" rel="nofollow noreferrer">Reference</a>] AKS implements this in all active namespaces through  <em>ConfigMaps</em>  named  <code>kube-root-ca.crt</code>  in these namespaces.</p>
<p>You shall also find a  <em>Service</em>  named  <code>kubernetes</code>  in the  <strong>default</strong>  namespace. It has a ServiceType of ClusterIP and  <strong>exposes the API Server  <em>Endpoint</em>  also named  <code>kubernetes</code>  internally to the cluster in the default namespace</strong>.</p>
<p>All the resources mentioned above will be created by design at the time of cluster creation and their creation  <strong>cannot be prevented</strong>. If you try to remove these resources manually, they will be recreated to ensure desired goal state by the  <code>kube-controller-manager</code>.</p>
</blockquote>
<p>Additionally:</p>
<blockquote>
<p>The  <a href="https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F9f061a12-e40d-4183-a00e-171812443373" rel="nofollow noreferrer">Kubernetes clusters should not use the default namespace</a>  Policy is still in  <strong>Preview</strong>. Currently the schema does not explicitly allow for Kubernetes resources in the  <strong>default</strong>  namespace to be excluded during policy evaluation. However, at the time of writing, the schema allows for  <code>labelSelector.matchExpressions[].operator</code>  which can be set to  <code>NotIn</code>  with appropriate  <code>labelSelector.matchExpressions[].values</code>  for the Service  <strong>default/kubernetes</strong>  with label:</p>
<p><code>component=apiserver</code></p>
<p>The default  <code>ServiceAccount</code>, the default  <code>ServiceAccount token Secret</code>  and the  <code>RootCA ConfigMap</code>  themselves are not created with any labels and hence cannot to added to this list. If this is impeding your use-case I would urge you to share your feedback at  <a href="https://techcommunity.microsoft.com/t5/azure/ct-p/Azure" rel="nofollow noreferrer">https://techcommunity.microsoft.com/t5/azure/ct-p/Azure</a></p>
</blockquote>
