C-0041 - HostNetwork access

HostNetwork access

Framework

ArmoBest, NSA, AllControls, YAML-scanning

Severity

High

Description of the the issue

We have it in ArmoBest

Related resources

CronJob, DaemonSet, Deployment, Job, Pod, ReplicaSet, StatefulSet

What does this control test

Remediation

Only connect PODs to host network when it is necessary. If not, set the hostNetwork field of the pod spec to false, or completely remove it (false is the default). Whitelist only those PODs that must have access to host network by design.

Example

apiVersion: v1
kind: Pod
metadata:
  name: ubuntu
  labels:
    app: ubuntu
spec:
  containers:
  - image: ubuntu
    name: ubuntu
  hostNetwork: true # we look for this attribute