Mount launched in privileged container

​

Event Information

​

Meaning

• The Mount Launched in Privileged Container event in a Kubernetes cluster indicates that a container has been launched with privileged access, allowing it to perform actions that are not restricted by the usual security measures.
• This event can be a potential security risk as privileged containers have elevated privileges and can bypass security controls, potentially leading to unauthorized access or malicious activities.
• To address this event, it is recommended to review the container specifications and ensure that privileged access is only granted when absolutely necessary. Regularly audit and monitor container configurations to identify and remediate any instances of privileged containers.

​

Remediation

1. Identify the privileged container:
   • Use the Kubernetes API to list all the pods in the affected namespace: kubectl get pods -n <namespace>
   • Look for the pod that triggered the event and note its name.
2. Modify the pod’s YAML manifest:
   • Retrieve the pod’s YAML manifest using the Kubernetes API: kubectl get pod <pod-name> -n <namespace> -o yaml > pod.yaml
   • Open the pod.yaml file and locate the container that is running in privileged mode.
   • Remove the securityContext section or set privileged: false within the container’s definition.
   • Save the changes to the pod.yaml file.
3. Apply the updated manifest:
   • Use the Kubernetes API to apply the updated manifest: kubectl apply -f pod.yaml -n <namespace>