Pod shares the node's namespaces (ARCH10022)

Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.

Key config.k8s.host-namespaces · Severity warning · Category security · CWE CWE-250

With hostNetwork, hostPID or hostIPC the pod shares the node’s network, process or IPC namespace: it sees, and can reach, what runs beside it on the node.

Incorrect

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      hostNetwork: true
      containers:
        - name: api
          image: example/api:3.2.0

Correct

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
        - name: api
          image: example/api:3.2.0
          ports:
            - containerPort: 8080

Fix

Remove the setting unless the workload is a node agent that cannot work without it.