Minimize The Admission Containers Wishing Share The Host Ipc Namespace

# 1) List all pods that request hostIPC
# Run on: any machine with kubectl access
kubectl get pods -A \
  -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOST_IPC:.spec.hostIPC' \
  --no-headers | grep -w true || echo "No pods with hostIPC: true found"

# 2) Show full specs for pods using hostIPC, for detailed review
# Run on: any machine with kubectl access
for ns in $(kubectl get pods -A \
  -o custom-columns='NAMESPACE:.metadata.namespace,HOST_IPC:.spec.hostIPC' \
  --no-headers | awk '$2=="true"{print $1}' | sort -u); do
  echo "### Namespace: $ns"
  kubectl get pods -n "$ns" \
    -o yaml | awk '/hostIPC: true/{p=1} p'
done

# 3) List namespaces that currently allow hostIPC via security policies (if using PodSecurityPolicy)
# Run on: any machine with kubectl access

# Show all PSPs and whether they allow hostIPC
kubectl get podsecuritypolicies.policy \
  -o custom-columns='NAME:.metadata.name,HOST_IPC:.spec.hostIPC' \
  --no-headers 2>/dev/null || echo "No PodSecurityPolicies found (or PSP not enabled)"

# Show which service accounts are bound to any PSP that allows hostIPC
for psp in $(kubectl get podsecuritypolicies.policy \
  -o jsonpath='{range .items[?(@.spec.hostIPC==true)]}{.metadata.name}{"\n"}{end}' 2>/dev/null); do
  echo "### PSP allowing hostIPC: $psp"
  kubectl get clusterrolebindings,rolebindings -A \
    -o jsonpath="{range .items[?(@.roleRef.kind=='PodSecurityPolicy' && @.roleRef.name=='$psp')]}{.kind}{'\t'}{.metadata.namespace}{'\t'}{.metadata.name}{'\n'}{end}" 2>/dev/null
done

# 4) If using Pod Security Admission (built-in Pod Security Standards), check namespace levels
# Run on: any machine with kubectl access
kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.labels}{"\n"}{end}'

# 5) Verify after review/changes: re-scan for hostIPC pods
# Run on: any machine with kubectl access
kubectl get pods -A \
  -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOST_IPC:.spec.hostIPC' \
  --no-headers | grep -w true || echo "No pods with hostIPC: true found"

#!/usr/bin/env bash
# Report pods, workloads, and namespaces that allow hostIPC:true
# Run on any machine with kubectl access and current-context set to the target cluster

set -euo pipefail

echo "=== 1) All pods currently running with hostIPC: true (cluster-wide) ==="
kubectl get pods -A -o json \
  | jq -r '
    .items[]
    | select(.spec.hostIPC == true)
    | [.metadata.namespace, .metadata.name, .spec.serviceAccountName]
    | @tsv' \
  | awk 'BEGIN {print "NAMESPACE\tPOD\tSERVICEACCOUNT"}1'

echo
echo "=== 2) Namespaces that currently contain any pod with hostIPC: true ==="
kubectl get pods -A -o json \
  | jq -r '
    .items[]
    | select(.spec.hostIPC == true)
    | .metadata.namespace' \
  | sort -u

echo
echo "=== 3) Workloads (Deployments/DaemonSets/StatefulSets/Jobs/CronJobs) configured with hostIPC: true ==="

for kind in deployment daemonset statefulset job cronjob; do
  echo
  echo "--- $kind objects with hostIPC: true ---"
  kubectl get "$kind" -A -o json 2>/dev/null \
    | jq -r '
        .items[]
        | select(.spec.template.spec.hostIPC == true)
        | [.kind, .metadata.namespace, .metadata.name]
        | @tsv' \
    | awk 'BEGIN {print "KIND\tNAMESPACE\tNAME"}1' || true
done

echo
echo "=== 4) PodSecurityPolicy objects that allow hostIPC ==="
# PSP is deprecated but still used in some clusters; include for completeness
if kubectl api-resources 2>/dev/null | grep -q "^podsecuritypolicies.extensions"; then
  kubectl get podsecuritypolicies -o json \
    | jq -r '
        .items[]
        | select(.spec.hostIPC == true)
        | .metadata.name' \
    | awk 'BEGIN {print "PSP_NAME"}1'
else
  echo "PodSecurityPolicy API not found in this cluster."
fi

echo
echo "=== 5) Namespaces and their Pod Security admission labels (if any) ==="
kubectl get ns --show-labels \
  | awk '
      NR==1 {print; next}
      {
        ns=$1; labels=$NF;
        printf "%-30s %s\n", ns, labels
      }'