Containers share the host network namespace misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_19
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	MEDIUM
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

When using the host network mode for a container, that container's network stack is not isolated from the Docker host, so the container shares the host's networking namespace and does not get its own IP-address allocation. To limit an attacker's options to escalate privileges from within a container, we recommend you to configure containers to not share the host network namespace.

How to Fix

Resource: Pod / Deployment / DaemonSet / StatefulSet / ReplicaSet / ReplicationController / Job / CronJob

• Arguments: hostNetwork (Optional) If true, the Pod uses the host's network namespace. Default to false. [source,go]

---

apiVersion: v1 kind: Pod metadata: name: spec:

• hostNetwork: false # or do not include hostNetwork

---

apiVersion: batch/v1beta1 kind: CronJob metadata: name: spec: schedule: <> jobTemplate: spec: template: spec:

• hostNetwork: false # or do not include hostNetwork

---

apiVersion: <> kind: metadata: name: spec: template: spec:

• hostNetwork: false # or do not include hostNetwork

---