> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Minimize Admission Containers Wishing Host IPC Namespace

### More Info:

Do not generally permit containers to be run with the hostIPC flag set to true.

### Risk Level

Critical

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. Identify pods currently using `hostIPC` (any machine with kubectl access):
           ```bash theme={null}
           kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | \
           while read -r pod_name pod_namespace; do
             pod_hostipc=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostIPC}' 2>/dev/null)
             if [ "${pod_hostipc}" = "true" ]; then
               echo "POD: ${pod_name} NAMESPACE: ${pod_namespace} hostIPC: true"
             fi
           done
           ```

        2. For each affected namespace, review whether any workload must legitimately use `hostIPC` (design/ops decision):
           * List pods and their controllers:
             ```bash theme={null}
             kubectl get pods -n <NAMESPACE> -o wide
             kubectl get deploy,sts,ds,job,cronjob -n <NAMESPACE>
             ```
           * With application owners, decide whether `hostIPC: true` is strictly required; if not, plan to remove it and block future use.

        3. Remove `hostIPC` from existing workload specs (any machine with kubectl access):
           * For a Deployment (repeat for other controllers as needed):
             ```bash theme={null}
             kubectl -n <NAMESPACE> get deploy <DEPLOYMENT_NAME> -o yaml > /tmp/deploy-no-hostipc.yaml
             ```
             Edit `/tmp/deploy-no-hostipc.yaml` and remove any line like:
             ```yaml theme={null}
             hostIPC: true
             ```
             from under `spec.template.spec`.
             * Apply the change:
               ```bash theme={null}
               kubectl apply -f /tmp/deploy-no-hostipc.yaml
               ```
           * Repeat similarly for StatefulSets, DaemonSets, Jobs, and CronJobs in that namespace.

        4. Create or update a PodSecurityPolicy (if still in use in your cluster) or Pod Security admission configuration to disallow `hostIPC` in user namespaces (any machine with kubectl access):

           **Example PodSecurityPolicy (if PSP enabled):**

           ```bash theme={null}
           cat >/tmp/psp-no-hostipc.yaml <<'EOF'
           apiVersion: policy/v1beta1
           kind: PodSecurityPolicy
           metadata:
             name: disallow-hostipc
           spec:
             hostIPC: false
             privileged: false
             seLinux:
               rule: RunAsAny
             runAsUser:
               rule: RunAsAny
             fsGroup:
               rule: RunAsAny
             supplementalGroups:
               rule: RunAsAny
             volumes:
             - '*'
           EOF

           kubectl apply -f /tmp/psp-no-hostipc.yaml
           ```

           Then bind it to service accounts in user namespaces:

           ```bash theme={null}
           cat >/tmp/psp-no-hostipc-rb.yaml <<'EOF'
           apiVersion: rbac.authorization.k8s.io/v1
           kind: ClusterRole
           metadata:
             name: use-psp-disallow-hostipc
           rules:
           - apiGroups: ["policy"]
             resources: ["podsecuritypolicies"]
             verbs: ["use"]
             resourceNames: ["disallow-hostipc"]
           ---
           apiVersion: rbac.authorization.k8s.io/v1
           kind: ClusterRoleBinding
           metadata:
             name: use-psp-disallow-hostipc
           roleRef:
             apiGroup: rbac.authorization.k8s.io
             kind: ClusterRole
             name: use-psp-disallow-hostipc
           subjects:
           - kind: Group
             name: system:serviceaccounts
             apiGroup: rbac.authorization.k8s.io
           EOF

           kubectl apply -f /tmp/psp-no-hostipc-rb.yaml
           ```

           If you use the built-in Pod Security admission instead of PSP, ensure user namespaces are labeled with a policy level that forbids `hostIPC` (e.g. `restricted`), after reviewing impact:

           ```bash theme={null}
           kubectl label namespace <NAMESPACE> pod-security.kubernetes.io/enforce=restricted --overwrite
           ```

        5. Test admission control behavior in a non-production namespace (any machine with kubectl access):
           ```bash theme={null}
           kubectl create namespace hostipc-test
           kubectl label namespace hostipc-test pod-security.kubernetes.io/enforce=restricted --overwrite

           cat >/tmp/hostipc-test-pod.yaml <<'EOF'
           apiVersion: v1
           kind: Pod
           metadata:
             name: hostipc-test-pod
             namespace: hostipc-test
           spec:
             hostIPC: true
             containers:
             - name: pause
               image: registry.k8s.io/pause:3.9
           EOF

           kubectl apply -f /tmp/hostipc-test-pod.yaml
           ```
           Confirm that admission is rejected (pod is not created and an error is returned). After testing, you may delete the test namespace:
           ```bash theme={null}
           kubectl delete namespace hostipc-test
           ```

        6. Verification (any machine with kubectl access):
           ```bash theme={null}
           kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | \
           while read -r pod_name pod_namespace; do
             pod_hostipc=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostIPC}' 2>/dev/null)
             if [ -z "${pod_hostipc}" ]; then
               pod_hostipc="false"
               echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: true"
             else
               echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: false"
             fi
           done
           ```
           Review output and ensure no pods report `is_pod_hostipc: true`.
      </Accordion>

      <Accordion title="Using kubectl">
        On any machine with kubectl access:

        1. Identify namespaces with user workloads (example list; adjust to your environment):

        ```bash theme={null}
        kubectl get ns
        ```

        2. Create a restrictive PodSecurityPolicy (if PSP is enabled) or a validating policy via a policy engine (e.g., Kyverno, Gatekeeper). Below are example manifests you can adapt; choose the mechanism actually available in your cluster.

        ### Example: Kyverno policy to block hostIPC pods

        Save as `deny-hostipc-pods.yaml`:

        ```yaml theme={null}
        apiVersion: kyverno.io/v1
        kind: ClusterPolicy
        metadata:
          name: disallow-hostipc
        spec:
          validationFailureAction: enforce
          background: true
          rules:
            - name: check-hostipc
              match:
                any:
                  - resources:
                      kinds:
                        - Pod
                      namespaces:
                        - "default"
                        - "prod"
                        - "staging"
              validate:
                message: "Using hostIPC is not allowed in this namespace."
                pattern:
                  spec:
                    =(hostIPC): "false"
        ```

        Apply:

        ```bash theme={null}
        kubectl apply -f deny-hostipc-pods.yaml
        ```

        Edit the `namespaces` list in the manifest to cover each namespace that hosts user workloads.

        ### Example: Gatekeeper (OPA) ConstraintTemplate + Constraint

        Save as `hostipc-template.yaml`:

        ```yaml theme={null}
        apiVersion: templates.gatekeeper.sh/v1beta1
        kind: ConstraintTemplate
        metadata:
          name: k8sdenydisallowedhostipc
        spec:
          crd:
            spec:
              names:
                kind: K8sDenyDisallowedHostIPC
          targets:
            - target: admission.k8s.gatekeeper.sh
              rego: |
                package k8sdenydisallowedhostipc

                violation[{"msg": msg}] {
                  input.review.kind.kind == "Pod"
                  hostipc := input.review.object.spec.hostIPC
                  hostipc == true
                  msg := "Using hostIPC is not allowed in this namespace."
                }
        ```

        Apply:

        ```bash theme={null}
        kubectl apply -f hostipc-template.yaml
        ```

        Then create a constraint, e.g. `hostipc-constraint.yaml`:

        ```yaml theme={null}
        apiVersion: constraints.gatekeeper.sh/v1beta1
        kind: K8sDenyDisallowedHostIPC
        metadata:
          name: disallow-hostipc
        spec:
          match:
            kinds:
              - apiGroups: [""]
                kinds: ["Pod"]
            namespaces:
              - "default"
              - "prod"
              - "staging"
        ```

        Apply:

        ```bash theme={null}
        kubectl apply -f hostipc-constraint.yaml
        ```

        Update the namespaces list as needed.

        ### Example: PodSecurityPolicy (only if PSP is enabled)

        Save as `psp-no-hostipc.yaml`:

        ```yaml theme={null}
        apiVersion: policy/v1beta1
        kind: PodSecurityPolicy
        metadata:
          name: psp-no-hostipc
        spec:
          privileged: false
          hostIPC: false
          seLinux:
            rule: RunAsAny
          runAsUser:
            rule: RunAsAny
          fsGroup:
            rule: RunAsAny
          supplementalGroups:
            rule: RunAsAny
          volumes:
            - '*'
        ```

        Apply:

        ```bash theme={null}
        kubectl apply -f psp-no-hostipc.yaml
        ```

        Then bind it per namespace (example for `prod`):

        ```yaml theme={null}
        # file: psp-no-hostipc-rb-prod.yaml
        apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
          name: use-psp-no-hostipc
          namespace: prod
        rules:
          - apiGroups: ["policy"]
            resources: ["podsecuritypolicies"]
            resourceNames: ["psp-no-hostipc"]
            verbs: ["use"]
        ---
        apiVersion: rbac.authorization.k8s.io/v1
        kind: RoleBinding
        metadata:
          name: use-psp-no-hostipc
          namespace: prod
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: Role
          name: use-psp-no-hostipc
        subjects:
          - kind: Group
            name: system:serviceaccounts:prod
            apiGroup: rbac.authorization.k8s.io
        ```

        Apply:

        ```bash theme={null}
        kubectl apply -f psp-no-hostipc-rb-prod.yaml
        ```

        Repeat the Role/RoleBinding per namespace that hosts user workloads.

        3. Verification (re-run the provided audit):

        ```bash theme={null}
        kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
        do
          pod_hostipc=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostIPC}' 2>/dev/null)
          if [ -z "${pod_hostipc}" ]; then
            pod_hostipc="false"
            echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: true"
          else
            echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: false"
          fi
        done
        ```

        Confirm no new pods with `is_pod_hostipc: true` can be created in the protected namespaces.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Purpose: Minimize admission of pods with hostIPC=true by applying a restrictive
        # PodSecurityPolicy/PodSecurityStandard-style policy (via PodSecurity admission labels)
        # to all user namespaces.
        #
        # Scope: Run on any machine with kubectl access and appropriate permissions.
        # Idempotent: Safe to re-run; it only adds/updates labels and does not delete objects.
        #
        # NOTE:
        # - This benchmark control is MANUAL: you must review workloads that truly need hostIPC.
        # - This script focuses on *preventing new* hostIPC pods in user namespaces.
        # - It does NOT modify or evict existing pods that already use hostIPC=true.

        set -euo pipefail

        # ------------- Configuration (EDIT IF NEEDED) ----------------

        # Regex to identify system namespaces which should be excluded from enforcement
        # (kube-system and similar). You can extend this list if needed.
        SYSTEM_NS_REGEX='^(kube-system|kube-public|kube-node-lease|default)$'

        # Desired Pod Security admission levels for user namespaces.
        # 'restricted' denies hostIPC and other privileged features.
        POD_SECURITY_ENFORCE_LEVEL="restricted"
        POD_SECURITY_AUDIT_LEVEL="restricted"
        POD_SECURITY_WARN_LEVEL="restricted"

        # --------------------------------------------------------------

        echo "[INFO] Verifying kubectl connectivity..."
        kubectl version --short >/dev/null

        echo "[INFO] Discovering namespaces..."
        all_namespaces=$(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')

        user_namespaces=()
        while IFS= read -r ns; do
          if [[ ! "$ns" =~ $SYSTEM_NS_REGEX ]]; then
            user_namespaces+=("$ns")
          fi
        done <<< "$all_namespaces"

        if [ ${#user_namespaces[@]} -eq 0 ]; then
          echo "[INFO] No user namespaces found (only system namespaces match). Nothing to do."
        else
          echo "[INFO] User namespaces to process:"
          printf '  - %s\n' "${user_namespaces[@]}"
        fi

        # ------------- Apply restrictive PodSecurity labels -------------

        for ns in "${user_namespaces[@]}"; do
          echo "[INFO] Applying PodSecurity labels to namespace: $ns"

          # Idempotent label application (add/update as needed)
          kubectl label namespace "$ns" \
            "pod-security.kubernetes.io/enforce=$POD_SECURITY_ENFORCE_LEVEL" \
            "pod-security.kubernetes.io/audit=$POD_SECURITY_AUDIT_LEVEL" \
            "pod-security.kubernetes.io/warn=$POD_SECURITY_WARN_LEVEL" \
            --overwrite
        done

        # ------------- Manual review guidance for existing hostIPC pods -------------

        echo "[INFO] Listing existing pods with hostIPC=true (for manual review)..."
        kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | \
        while read -r pod_name pod_namespace; do
          pod_hostipc=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostIPC}' 2>/dev/null || true)
          if [ -n "${pod_hostipc}" ] && [ "${pod_hostipc}" = "true" ]; then
            echo "  [WARNING] Existing hostIPC pod: ${pod_namespace}/${pod_name}"
          fi
        done || true

        cat <<'EOF'

        [NOTE] The control is MANUAL:
        - Review each WARNING line above to determine if hostIPC=true is strictly necessary.
        - For each workload where hostIPC is not required, update its Deployment/PodSpec to remove `hostIPC: true`.
        - For workloads that truly require hostIPC, consider:
          * Running them only in tightly controlled namespaces.
          * Applying more targeted admission controls (e.g., admission webhook, Gatekeeper policies).

        EOF

        # ------------- Verification (adapted from audit) ----------------

        echo "[INFO] Re-running audit to verify current state of hostIPC usage..."
        kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | \
        while read -r pod_name pod_namespace; do
          pod_hostipc=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostIPC}' 2>/dev/null || true)
          if [ -z "${pod_hostipc}" ]; then
            pod_hostipc="false"
            echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: true"
          else
            echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: false"
          fi
        done
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/concepts/security/pod-security-standards/](https://kubernetes.io/docs/concepts/security/pod-security-standards/)