Control: ReplicationController containers should not run with host network access

Description

Containers in a ReplicationController should not run in the host network of the node where the pod is deployed. When running on the host network, the pod can use the network namespace and network resources of the node. In this case, the pod can access loopback devices, listen to addresses, and monitor the traffic of other pods on the node.

Usage

Run the control in your terminal:

powerpipe control run kubernetes_compliance.control.replication_controller_host_network_access_disabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run kubernetes_compliance.control.replication_controller_host_network_access_disabled --share

SQL

This control uses a named query:

select
  coalesce(uid, concat(path, ':', start_line)) as resource,
  case
    when (template -> 'spec' ->> 'hostNetwork')::bool then 'alarm'
    else 'ok'
  end as status,
  case
    when (template -> 'spec' ->> 'hostNetwork')::bool then 'ReplicationController pods using host network.'
    else 'ReplicationController pods not using host network.'
  end as reason,
  name as replication_controller_name
  
  , coalesce(context_name, '') as context_name, namespace, source_type, coalesce(path || ':' || start_line || '-' || end_line, '') as path
from
  kubernetes_replication_controller;

Control: ReplicationController containers should not run with host network access

Description

Usage

SQL

Tags