Minimize Admission Containers Wishing Share Host Ipc Namespace

# 1) Create a baseline policy that denies hostIPC in all user namespaces
# Run on: any machine with kubectl access

cat << 'EOF' > deny-hostipc-psp.yaml
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: deny-hostipc
spec:
  privileged: false
  hostIPC: false
  hostNetwork: false
  hostPID: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
EOF

kubectl apply -f deny-hostipc-psp.yaml

# 2) For each namespace with user workloads, bind the PSP and (optionally) add a label.
# Replace <namespace> with the actual namespace name. Repeat per namespace.

NAMESPACE=<namespace>

kubectl label namespace "${NAMESPACE}" \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest \
  --overwrite

cat << EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: psp:deny-hostipc
  namespace: ${NAMESPACE}
rules:
  - apiGroups: ['policy']
    resources: ['podsecuritypolicies']
    resourceNames: ['deny-hostipc']
    verbs: ['use']
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: use:psp:deny-hostipc
  namespace: ${NAMESPACE}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: psp:deny-hostipc
subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: system:serviceaccounts:${NAMESPACE}
EOF

# 3) Verification: confirm no pods are admitted with hostIPC=true
# Run on: any machine with kubectl access

kubectl get pods --all-namespaces -o json | jq -r 'if any(.items[]?; .spec.hostIPC == true) then "HOSTIPC_FOUND" else "NO_HOSTIPC" end'

#!/usr/bin/env bash
set -euo pipefail

# Automation for: Minimize admission of containers wishing to share the host IPC namespace
# Scope: any machine with kubectl access to the cluster

# This script:
# - Creates/updates a Pod Security admission label on every non-system namespace
#   to disallow hostIPC
# - Verifies no pods are using hostIPC

# REQUIREMENTS:
# - kubectl configured with cluster-admin permissions
# - jq installed

# CONFIGURATION:
# Policy: use Pod Security Admission label equivalent to baseline/restricted behavior
#         which forbids hostIPC.
PSA_LEVEL="restricted"
PSA_MODE="enforce"

echo "Discovering namespaces..."
# Exclude Kubernetes/system namespaces; adjust the grep -Ev pattern if needed for your cluster.
NAMESPACES=$(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' \
  | grep -Ev '^(kube-system|kube-public|kube-node-lease)$' || true)

if [ -z "${NAMESPACES}" ]; then
  echo "No non-system namespaces found; nothing to label."
else
  echo "Applying Pod Security labels to namespaces:"
  echo "${NAMESPACES}"
  while read -r ns; do
    [ -z "$ns" ] && continue
    echo "  -> Patching namespace: ${ns}"
    kubectl label namespace "${ns}" \
      "pod-security.kubernetes.io/enforce=${PSA_LEVEL}" \
      "pod-security.kubernetes.io/enforce-version=latest" \
      --overwrite
  done <<< "${NAMESPACES}"
fi

echo "Waiting briefly for admission changes to take effect..."
sleep 5

echo "Verifying that no pods are using hostIPC..."
RESULT=$(kubectl get pods --all-namespaces -o json \
  | jq -r 'if any(.items[]?; .spec.hostIPC == true) then "HOSTIPC_FOUND" else "NO_HOSTIPC" end')

if [ "${RESULT}" = "NO_HOSTIPC" ]; then
  echo "Verification PASSED: no pods with hostIPC=true detected."
  exit 0
fi

echo "Verification WARNING: pods with hostIPC=true are still present."
echo "Details:"
kubectl get pods --all-namespaces -o json \
  | jq -r '.items[] | select(.spec.hostIPC == true) | "\(.metadata.namespace) \(.metadata.name)"'

echo
echo "New hostIPC=true pods should now be blocked by admission; existing pods must be handled manually:"
echo "  - Review and delete or re-deploy these pods without hostIPC"
echo "  - Then re-run this script to confirm a clean state"

exit 1