Skip to main content

Minimize The Admission Containers Wishing Share The Host

More Info:​

Do not generally permit containers to be run with the hostIPC flag set to true.

Risk Level​

Critical

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS GKE
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. Identify all pods using hostIPC: true

    • Run on: any machine with kubectl access
    kubectl get pods --all-namespaces -o json | jq -r '
      .items[]
      | select(.spec.hostIPC == true)
      | "\(.metadata.namespace) \(.metadata.name)"'

    If jq is unavailable:

    kubectl get pods --all-namespaces -o jsonpath='{range .items[?(@.spec.hostIPC==true)]}{.metadata.namespace}{" "}{.metadata.name}{"\n"}{end}'

  2. Map pods to their controllers and manifests

    • For each <namespace> <pod> from step 1, run:
    kubectl -n <namespace> get pod <pod> -o json | jq -r '
      .metadata.ownerReferences[]? 
      | "\(.kind) \(.name)"'
    • Note the owning Deployment / StatefulSet / DaemonSet / Job / ReplicaSet (or Pod if standalone). Locate and open the corresponding manifest in your Git/IaC repo if applicable.

  3. Review necessity of hostIPC per workload

    • For each owning object, inspect the spec:
    kubectl -n <namespace> get <kind> <name> -o yaml | sed -n "/spec:/,/status:/p" | sed '/status:/q'
    • Look for hostIPC: true. With application owners, confirm whether sharing the host IPC namespace is strictly required (e.g., for specific low-level IPC use cases). If not clearly justified, mark it for removal.

  4. Adjust manifests to remove or avoid hostIPC: true

    • In your deployment manifests (Git/IaC or exported YAML), remove the hostIPC: true line from the pod spec, or set it to false only if you must be explicit:
    spec:
      # remove this if present
      # hostIPC: true
    • Apply the corrected manifests:
    kubectl apply -f <corrected-manifest>.yaml

  5. Optionally define restrictive policy (PSP-equivalent or admission policy)

    • If you use PodSecurityPolicy (legacy) or a replacement (e.g., Pod Security Admission, Gatekeeper, Kyverno), author a policy that disallows hostIPC: true except in tightly scoped namespaces. Example evidence command to inspect existing PSPs (if in use):
    kubectl get psp -o yaml | grep -nA5 hostIPC
    • For Pod Security Admission, verify namespaces are at least baseline (which disallows host namespaces by default):
    kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{" "}{.metadata.labels}{"\n"}{end}'

  6. Verify no remaining pods use hostIPC: true

    • After changes roll out, rerun:
    kubectl get pods --all-namespaces -o jsonpath='{range .items[?(@.spec.hostIPC==true)]}{.metadata.namespace}{" "}{.metadata.name}{"\n"}{end}'
    • Confirm the command returns no output, or only the small, explicitly approved set you intended to keep. Document any approved exceptions with their justification.
Using kubectl
# 1) List all pods that request hostIPC
# Run on: any machine with kubectl access
kubectl get pods -A \
  -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOST_IPC:.spec.hostIPC' \
  --no-headers | grep -w true || echo "No pods with hostIPC: true found"

Interpretation:
Any line printed (not the final “No pods…” message) shows a pod with HOST_IPC set to true. Each such pod needs review: confirm whether sharing the host IPC namespace is strictly required.

# 2) Show full specs for pods using hostIPC, for detailed review
# Run on: any machine with kubectl access
for ns in $(kubectl get pods -A \
  -o custom-columns='NAMESPACE:.metadata.namespace,HOST_IPC:.spec.hostIPC' \
  --no-headers | awk '$2=="true"{print $1}' | sort -u); do
  echo "### Namespace: $ns"
  kubectl get pods -n "$ns" \
    -o yaml | awk '/hostIPC: true/{p=1} p'
done

Interpretation:
Inspect each pod spec that includes hostIPC: true. Use this to decide which workloads can safely be modified to drop hostIPC.

# 3) List namespaces that currently allow hostIPC via security policies (if using PodSecurityPolicy)
# Run on: any machine with kubectl access

# Show all PSPs and whether they allow hostIPC
kubectl get podsecuritypolicies.policy \
  -o custom-columns='NAME:.metadata.name,HOST_IPC:.spec.hostIPC' \
  --no-headers 2>/dev/null || echo "No PodSecurityPolicies found (or PSP not enabled)"

# Show which service accounts are bound to any PSP that allows hostIPC
for psp in $(kubectl get podsecuritypolicies.policy \
  -o jsonpath='{range .items[?(@.spec.hostIPC==true)]}{.metadata.name}{"\n"}{end}' 2>/dev/null); do
  echo "### PSP allowing hostIPC: $psp"
  kubectl get clusterrolebindings,rolebindings -A \
    -o jsonpath="{range .items[?(@.roleRef.kind=='PodSecurityPolicy' && @.roleRef.name=='$psp')]}{.kind}{'\t'}{.metadata.namespace}{'\t'}{.metadata.name}{'\n'}{end}" 2>/dev/null
done

Interpretation:
Any PodSecurityPolicy with .spec.hostIPC: true permits use of the host IPC namespace. Any role/clusterrolebinding referencing such a PSP extends that permission to the bound subjects (service accounts, users, groups). Those namespaces and identities need review to confirm hostIPC use is intentional and tightly scoped.

# 4) If using Pod Security Admission (built-in Pod Security Standards), check namespace levels
# Run on: any machine with kubectl access
kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.labels}{"\n"}{end}'

Interpretation:
Identify namespaces not labeled with a restrictive policy (e.g., pod-security.kubernetes.io/enforce=restricted). Namespaces with no or permissive labels are more likely to admit pods with hostIPC: true and should be reviewed and, where appropriate, tightened.

# 5) Verify after review/changes: re-scan for hostIPC pods
# Run on: any machine with kubectl access
kubectl get pods -A \
  -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOST_IPC:.spec.hostIPC' \
  --no-headers | grep -w true || echo "No pods with hostIPC: true found"

Interpretation:
If only the final “No pods with hostIPC: true found” line appears, there are currently no pods requesting the host IPC namespace. If any pods still show HOST_IPC as true, those remaining cases must be explicitly accepted as exceptions or further remediated.

Automation
#!/usr/bin/env bash
# Report pods, workloads, and namespaces that allow hostIPC:true
# Run on any machine with kubectl access and current-context set to the target cluster

set -euo pipefail

echo "=== 1) All pods currently running with hostIPC: true (cluster-wide) ==="
kubectl get pods -A -o json \
  | jq -r '
    .items[]
    | select(.spec.hostIPC == true)
    | [.metadata.namespace, .metadata.name, .spec.serviceAccountName]
    | @tsv' \
  | awk 'BEGIN {print "NAMESPACE\tPOD\tSERVICEACCOUNT"}1'

echo
echo "=== 2) Namespaces that currently contain any pod with hostIPC: true ==="
kubectl get pods -A -o json \
  | jq -r '
    .items[]
    | select(.spec.hostIPC == true)
    | .metadata.namespace' \
  | sort -u

echo
echo "=== 3) Workloads (Deployments/DaemonSets/StatefulSets/Jobs/CronJobs) configured with hostIPC: true ==="

for kind in deployment daemonset statefulset job cronjob; do
  echo
  echo "--- $kind objects with hostIPC: true ---"
  kubectl get "$kind" -A -o json 2>/dev/null \
    | jq -r '
        .items[]
        | select(.spec.template.spec.hostIPC == true)
        | [.kind, .metadata.namespace, .metadata.name]
        | @tsv' \
    | awk 'BEGIN {print "KIND\tNAMESPACE\tNAME"}1' || true
done

echo
echo "=== 4) PodSecurityPolicy objects that allow hostIPC ==="
# PSP is deprecated but still used in some clusters; include for completeness
if kubectl api-resources 2>/dev/null | grep -q "^podsecuritypolicies.extensions"; then
  kubectl get podsecuritypolicies -o json \
    | jq -r '
        .items[]
        | select(.spec.hostIPC == true)
        | .metadata.name' \
    | awk 'BEGIN {print "PSP_NAME"}1'
else
  echo "PodSecurityPolicy API not found in this cluster."
fi

echo
echo "=== 5) Namespaces and their Pod Security admission labels (if any) ==="
kubectl get ns --show-labels \
  | awk '
      NR==1 {print; next}
      {
        ns=$1; labels=$NF;
        printf "%-30s %s\n", ns, labels
      }'

How to interpret the output

  • Problems / items to review:
    • Any entry in section 1): pods listed there are currently running with hostIPC: true.
    • Any namespace listed in section 2): these namespaces host at least one such pod.
    • Any workload listed in section 3): these controllers are configured to create pods with hostIPC: true (persistent risk).
    • Any PSP listed in section 4) with hostIPC allowed: these policies permit hostIPC: true.
  • These outputs should be reviewed to decide whether hostIPC: true is strictly necessary and, if not, have manifests/PSPs updated so that .spec.hostIPC is omitted or set to false.

Additional Reading:​