Containers share host IPC namespace misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_18
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	MEDIUM
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

Pods share many resources, so it could make sense to share a process namespace. Some container images may expect to be isolated from other containers. Not sharing IPC namespaces helps ensure isolation. Containers in different pods have distinct IP addresses and will need special configuration to communicate by IPC.

How to Fix

Resource: Pod / Deployment / DaemonSet / StatefulSet / ReplicaSet / ReplicationController / Job / CronJob

• Arguments: hostIPC (Optional) If true, the Pod uses the host's IPC namespace. Default to false. [source,go]

---

apiVersion: v1 kind: Pod metadata: name: spec:

• hostIPC: false # or do not include hostIPC

---

apiVersion: batch/v1beta1 kind: CronJob metadata: name: spec: schedule: <> jobTemplate: spec: template: spec:

• hostIPC: false # or do not include hostIPC

---

apiVersion: <> kind: metadata: name: spec: template: spec:

• hostIPC: false # or do not include hostIPC

---