Control: ReplicaSet containers should not run with host network access
Description
Containers in a ReplicaSet should not run in the host network of the node where the pod is deployed. When running on the host network, the pod can use the network namespace and network resources of the node. In this case, the pod can access loopback devices, listen to addresses, and monitor the traffic of other pods on the node.
Usage
Run the control in your terminal:
powerpipe control run kubernetes_compliance.control.replicaset_host_network_access_disabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run kubernetes_compliance.control.replicaset_host_network_access_disabled --shareSQL
This control uses a named query:
select coalesce(uid, concat(path, ':', start_line)) as resource, case when (template -> 'spec' ->> 'hostNetwork')::bool then 'alarm' else 'ok' end as status, case when (template -> 'spec' ->> 'hostNetwork')::bool then 'ReplicaSet pods using host network.' else 'ReplicaSet pods not using host network.' end as reason, name as replicaset_name , coalesce(context_name, '') as context_name, namespace, source_type, coalesce(path || ':' || start_line || '-' || end_line, '') as pathfrom kubernetes_replicaset;