Minimize Admission Of Containers HostPorts

# 1) List all namespaces to scope your review
# Run on: any machine with kubectl access
kubectl get namespaces -o name

# 2) Find all Pods that currently use hostPort in all namespaces
# Run on: any machine with kubectl access
kubectl get pods -A -o jsonpath='{range .items[*]}{@.metadata.namespace}{" "}{@.metadata.name}{"\n"}{range @.spec.containers[*]}{range @.ports[*]}{..hostPort}{"\n"}{end}{end}{end}' | paste - - | grep -v ' $'

# 3) See full Pod specs using hostPort in a specific namespace
# Replace NAMESPACE with a namespace you identified above
kubectl get pods -n NAMESPACE -o yaml | grep -nA5 -B10 "hostPort:"

# 4) Identify PodSecurityPolicy or admission policies that already restrict hostPorts (if PSP is in use)
kubectl get podsecuritypolicies.policy -o yaml | grep -nA10 "hostPorts"

# 5) Inspect Pod Security admission labels (if using Pod Security Standards)
kubectl get ns --show-labels

# 6) For a specific namespace, list all workload manifests to review for hostPort
kubectl get deploy,ds,sts,job,cronjob -n NAMESPACE -o yaml | grep -nA5 -B10 "hostPort:"

#!/usr/bin/env bash
set -euo pipefail

# This script reports:
# 1) All Pods using hostPort
# 2) All workloads (Deployments/DaemonSets/StatefulSets/ReplicaSets/Jobs/CronJobs)
#    that define hostPort in their Pod templates
# 3) Namespaces that lack a policy to restrict hostPorts (basic Gatekeeper/PSA hints)

TS="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
echo "=== HostPort usage report (${TS}) ==="
echo

###############################################################################
# 1) LIVE PODS USING hostPort
###############################################################################
echo "1) Pods currently running with hostPort set"
echo "------------------------------------------"

kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | {ns: .metadata.namespace, name: .metadata.name, spec: .spec}
    | .spec.containers + (.spec.initContainers // [])
    | map({
        ns:   input_filename? // "N/A",
        name: .name,
        hostPort: (.ports // [] | map(select(.hostPort != null)) | .[])
      })' 2>/dev/null >/dev/null && : || true

# simpler, robust jq:
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | . as $pod
    | ($pod.spec.containers + ($pod.spec.initContainers // []))
    | map(
        .ports // []
        | map(select(.hostPort != null)
          | {
              namespace: $pod.metadata.namespace,
              pod:       $pod.metadata.name,
              container: .name? // "N/A",
              hostPort:  .hostPort
            }
        )
      )
    | add // empty
  ' | sort -u || true

echo
echo "If any lines are printed above, those Pods are using hostPort and should be reviewed:"
echo "- Confirm business need for hostPort."
echo "- Prefer Service types (NodePort/LoadBalancer) or Ingress instead of hostPort."
echo

###############################################################################
# 2) WORKLOAD TEMPLATES DEFINING hostPort
###############################################################################
echo "2) Workloads whose Pod templates define hostPort"
echo "-----------------------------------------------"

# Helper function: scan a workload type
scan_workload() {
  local kind="$1"
  kubectl get "${kind}" --all-namespaces -o json 2>/dev/null \
    | jq -r --arg KIND "${kind}" '
      .items[]
      | . as $w
      | ($w.spec.template.spec.containers + ($w.spec.template.spec.initContainers // []))
      | map(
          .ports // []
          | map(select(.hostPort != null)
            | {
                kind:      $KIND,
                namespace: $w.metadata.namespace,
                name:      $w.metadata.name,
                container: .name? // "N/A",
                hostPort:  .hostPort
              }
          )
        )
      | add // empty
    ' || true
}

for k in deployments.apps daemonsets.apps statefulsets.apps replicasets.apps jobs.batch cronjobs.batch; do
  scan_workload "$k"
done | sort -u

echo
echo "Any workloads listed above have hostPort in their Pod spec templates."
echo "These should be considered non-compliant unless there is a documented exception."
echo

###############################################################################
# 3) NAMESPACE-LEVEL POLICY HINTS
###############################################################################
echo "3) Namespace-level policies related to hostPort / Pod Security"
echo "-------------------------------------------------------------"

echo "3.a) Namespaces with PodSecurity admission labels (baseline/restricted)"
kubectl get ns --show-labels \
  | sed 's/,/\n    /g' \
  | awk 'NR==1 || /pod-security.kubernetes.io/'

echo
echo "Namespaces without pod-security.kubernetes.io labels likely rely on default cluster policy."
echo "They may allow hostPorts unless restricted by another admission controller (e.g., Gatekeeper)."
echo

echo "3.b) Gatekeeper (if installed): Constraints that mention hostPort"
if kubectl get crd constraints.gatekeeper.sh >/dev/null 2>&1; then
  kubectl get constraints.constraints.gatekeeper.sh --all-namespaces -o yaml 2>/dev/null \
    | grep -i -n 'hostPort' || echo "No Gatekeeper constraints mentioning hostPort found."
else
  echo "Gatekeeper constraints CRD not detected; skipping Gatekeeper policy scan."
fi

echo
echo "INTERPRETING POLICY OUTPUT:"
echo "- Namespaces that run user workloads and have Pods/workloads using hostPort"
echo "  but no evident PodSecurity labels or hostPort-related constraints are likely risky."
echo "- Even with PodSecurity labels, you must verify that the policy level in use"
echo "  actually disallows hostPort where it is not required."
echo
echo "Review the above data and decide, per namespace, which hostPort usages are justified."

chmod +x report-hostport-usage.sh

./report-hostport-usage.sh