hostPort is specified misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_26
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

The hostPort setting applies to the Kubernetes containers. The container port will be exposed to the external network at :, where the hostIP is the IP address of the Kubernetes node where the container is running, and the hostPort is the port requested by the user.

We recommend that you do not specify a hostPort for a pod unless it is absolutely necessary. When you bind a pod to a hostPort, it limits the number of places the pod can be scheduled, because each <hostIP, hostPort, protocol> combination must be unique.

NOTE: If you do not specify the hostIP and protocol explicitly, Kubernetes will use 0.0.0.0 as the default hostIP and TCP as the default protocol. This will expose your host to the internet.

How to Fix

Kubernetes

• Resource: Container
• Arguments: hostPort (Optional)

Defines the number of port to expose on the host. [source,go]

apiVersion: v1 kind: Pod metadata: name: spec: containers:

• name: image: ports:
• hostPort:

---