Skip to main content

OCI OKE Should Minimize Containers Sharing the Host IPC

More Info:​

Containers running with hostIPC=true share the hosts inter-process communication namespace and can read or send signals to other processes on the node. Block this in admission policy except for explicit, audited use cases.

Risk Level​

High

Address​

Compliance, Security

Compliance Standards​

  • CIS OKE

Triage and Remediation​

Remediation​

Using Console

To remediate “Containers sharing the host IPC namespace” (hostIPC: true) in OCI OKE via the OCI Console, you essentially need to:

  1. Find workloads using hostIPC: true.
  2. Update their Pod/Deployment specs to remove it.
  3. Optionally enforce a policy so it doesn’t reappear.

Below are step‑by‑step instructions using only the OCI Console (with Cloud Shell/kubectl from the console).

1. Open your OKE cluster from the OCI Console​

  1. Sign in to the OCI Console.
  2. In the left-hand menu, go to:
    Developer Services → Containers & Artifacts → Kubernetes Clusters (OKE).
  3. Select the Compartment where your cluster lives.
  4. Click your OKE cluster name to open its details page.

2. Connect to the cluster using Cloud Shell from the Console​

  1. On the cluster details page, find the “Access Cluster” or “Cluster Access” section.
  2. Click “Cloud Shell” (or the Cloud Shell icon in the top-right of the console).
    • This opens a terminal at the bottom of the console.
  3. In the cluster page, click “Copy kubeconfig” or follow the “Access Cluster” instructions:
    • Usually: 
      oci ce cluster create-kubeconfig \
        --cluster-id <cluster-ocid> \
        --file $HOME/.kube/config \
        --region <your-region> \
        --token-version 2.0.0 \
        --kube-endpoint PUBLIC_ENDPOINT
    • Then verify: 
      kubectl get nodes
    • If nodes are shown, you are connected.

3. Identify Pods/Workloads using hostIPC: true​

From Cloud Shell (still in the console):

  1. List all pods (all namespaces) including their full spec: 
    kubectl get pods -A -o yaml | grep -n "hostIPC"
  2. Or search at deployment level: 
    kubectl get deploy,statefulset,daemonset -A -o yaml | grep -n "hostIPC"

Any occurrence like:

spec:
  hostIPC: true

indicates a misconfiguration.

Note the namespace and name of the workload where you see hostIPC: true.

4. Edit each workload and remove hostIPC: true​

For each Deployment/StatefulSet/DaemonSet found:

  1. Edit a Deployment (example): 
    kubectl -n <namespace> edit deploy <deployment-name>
  2. In the editor that opens, look for: 
    spec:
      template:
        spec:
          hostIPC: true
  3. Remove the line hostIPC: true entirely (or change to false): 
    spec:
      template:
        spec:
          # hostIPC: true   <-- remove this line
  4. Save and exit (in vi: press Esc, then :wq and Enter).
  5. Kubernetes will roll out a new ReplicaSet without hostIPC.

For a StatefulSet or DaemonSet, same pattern:

kubectl -n <namespace> edit statefulset <name>
kubectl -n <namespace> edit daemonset <name>

If you have naked Pods (not managed by a controller):

kubectl -n <namespace> edit pod <pod-name>

Note: if the pod is part of a Deployment/Set, always edit the controller, not the individual pod.

5. Confirm hostIPC is no longer used​

Run again from Cloud Shell:

kubectl get pods -A -o yaml | grep -n "hostIPC"

No output means no pod is currently configured with hostIPC: true.

6. (Optional) Add a policy to prevent hostIPC in the future​

OKE doesn’t manage this directly in the OCI Console UI; you use Kubernetes admission controls from the console via Cloud Shell.

If your cluster uses Kubernetes ≥1.25 and you can label namespaces:

  1. Choose a Pod Security Standard level, e.g., restricted (which disallows host namespaces like hostIPC).

  2. From Cloud Shell, label your namespaces, for example:

    # Example: enforce restricted pod security in a namespace
    kubectl label namespace <namespace> \
      pod-security.kubernetes.io/enforce=restricted \
      --overwrite

restricted policy will block pods using hostIPC: true.

6.2 Or use OPA Gatekeeper / Kyverno (if you already have it)​

If Gatekeeper is installed, create a ConstraintTemplate/Constraint that forbids spec.hostIPC: true. (Ask if you want the exact YAML.)

7. If the misconfiguration came from Helm or CI/CD​

If workloads are redeployed by Helm or pipelines, you must also:

  1. Update the Helm chart values or YAML manifests in your repo:
    • Remove or set hostIPC: false in the template: 
      spec:
        hostIPC: false
  2. Re‑deploy from your pipeline/Helm to ensure it doesn’t reintroduce the setting.

If you share a specific OKE version and example YAML with hostIPC: true, I can give an exact patch command or manifest to apply from Cloud Shell.

Using CLI

In OKE this is a Kubernetes-level setting (hostIPC: true in pod specs). Remediation is:

  1. Make sure you can talk to the cluster via CLI

    # 1. Get cluster OCID
    oci ce cluster list --compartment-id <compartment_ocid>

    # 2. Generate kubeconfig for this cluster
    oci ce cluster create-kubeconfig \
      --cluster-id <cluster_ocid> \
      --file $HOME/.kube/oke-config \
      --region <region> \
      --token-version 2.0.0 \
      --kube-endpoint PUBLIC_ENDPOINT

    export KUBECONFIG=$HOME/.kube/oke-config

    # 3. Verify kubectl works
    kubectl get nodes

  2. Find workloads using hostIPC: true

    This flag can be set at pod or pod-template level.

    # Check all namespaces
    kubectl get pods -A -o yaml | grep -n "hostIPC: true" -B3 -A5

    # Check Deployments
    kubectl get deploy -A -o yaml | grep -n "hostIPC: true" -B5 -A10

    # Check StatefulSets
    kubectl get statefulset -A -o yaml | grep -n "hostIPC: true" -B5 -A10

    # Check DaemonSets
    kubectl get daemonset -A -o yaml | grep -n "hostIPC: true" -B5 -A10

  3. Edit the manifests to disable host IPC

    For each object you found (Deployment, StatefulSet, DaemonSet, Pod):

    # Example: edit a deployment in place
    kubectl -n <namespace> edit deployment <name>

    In the resulting YAML, locate the pod spec and remove or set:

    spec:
      template:
        spec:
          hostIPC: false   # or remove the line entirely

    Save and exit. Kubernetes will roll out new pods without host IPC.

    Repeat for any StatefulSets, DaemonSets, or standalone Pods:

    kubectl -n <namespace> edit statefulset <name>
    kubectl -n <namespace> edit daemonset <name>
    kubectl -n <namespace> edit pod <name>   # for static/one-off pods

  4. Verify that host IPC is no longer used

    # Re-check for hostIPC: true
    kubectl get pods -A -o yaml | grep -n "hostIPC: true" -B3 -A5 || echo "No pods using hostIPC"

    # Optionally check pod descriptions
    kubectl -n <namespace> describe pod <pod_name> | grep -i hostIPC || echo "Not set"

  5. (Recommended) Enforce policy so hostIPC cannot be re-enabled

    Use Kubernetes Pod Security Admission (if 1.25+) or Gatekeeper.

    Option A – Pod Security Admission (namespace labels)

    For “restricted” policy level (blocks host IPC):

    # Label namespaces to enforce restricted pod security
    kubectl label namespace <ns> \
      pod-security.kubernetes.io/enforce=restricted \
      pod-security.kubernetes.io/enforce-version=latest \
      --overwrite

    This will reject new pods with hostIPC: true in those namespaces.

    Option B – Gatekeeper constraint (if you have Gatekeeper installed)

    Example K8sPSPHostIPC constraint:

    apiVersion: constraints.gatekeeper.sh/v1beta1
    kind: K8sPSPHostIPC
    metadata:
      name: disallow-hostipc
    spec:
      match:
        kinds:
          - apiGroups: [""]
            kinds: ["Pod"]
        namespaces:
          - "<your-namespace>"   # or omit to apply cluster-wide

    Apply:

    kubectl apply -f disallow-hostipc.yaml

Summary of OCI CLI use:

  1. Use oci ce cluster create-kubeconfig to set kubeconfig.
  2. Use kubectl to:
    • discover pods with hostIPC: true,
    • edit workloads to remove hostIPC,
    • optionally enforce namespace-level Pod Security labels or Gatekeeper constraints.
Using Python

To minimize containers sharing the host IPC namespace in OKE, you need to:

  1. Detect all workloads using hostIPC: true.
  2. Patch them to remove or disable hostIPC.
  3. Optionally enforce a policy so it can’t be reintroduced.

Below is how to do this in OKE using Python and the Kubernetes Python client.

1. Prerequisites​

pip install kubernetes

Make sure your local kubeconfig is set to point to your OKE cluster:

kubectl config use-context <your-oke-context>

2. Python: Find all workloads with hostIPC: true​

This scans Deployments, StatefulSets, DaemonSets, ReplicaSets, and Pods.

from kubernetes import client, config

def has_hostipc(pod_spec):
    return getattr(pod_spec, "host_ipc", False) is True

def main():
    # Load kubeconfig
    config.load_kube_config()  # or config.load_incluster_config() if running inside a pod

    apps_v1 = client.AppsV1Api()
    core_v1 = client.CoreV1Api()

    # Namespaces to scan (None => all)
    namespaces = [ns.metadata.name for ns in core_v1.list_namespace().items]

    for ns in namespaces:
        print(f"\nNamespace: {ns}")

        # Deployments
        for d in apps_v1.list_namespaced_deployment(ns).items:
            if has_hostipc(d.spec.template.spec):
                print(f"Deployment with hostIPC: {d.metadata.name}")

        # StatefulSets
        for ss in apps_v1.list_namespaced_stateful_set(ns).items:
            if has_hostipc(ss.spec.template.spec):
                print(f"StatefulSet with hostIPC: {ss.metadata.name}")

        # DaemonSets
        for ds in apps_v1.list_namespaced_daemon_set(ns).items:
            if has_hostipc(ds.spec.template.spec):
                print(f"DaemonSet with hostIPC: {ds.metadata.name}")

        # ReplicaSets (if needed)
        for rs in apps_v1.list_namespaced_replica_set(ns).items:
            if has_hostipc(rs.spec.template.spec):
                print(f"ReplicaSet with hostIPC: {rs.metadata.name}")

        # Standalone Pods
        for p in core_v1.list_namespaced_pod(ns).items:
            if has_hostipc(p.spec):
                print(f"Pod with hostIPC: {p.metadata.name}")

if __name__ == "__main__":
    main()

3. Python: Patch workloads to disable hostIPC​

This sets hostIPC: false on matching workloads.

from kubernetes import client, config

def patch_hostipc_false():
    config.load_kube_config()
    apps_v1 = client.AppsV1Api()
    core_v1 = client.CoreV1Api()

    namespaces = [ns.metadata.name for ns in core_v1.list_namespace().items]

    def patch_deployment(ns, name):
        body = {"spec": {"template": {"spec": {"hostIPC": False}}}}
        apps_v1.patch_namespaced_deployment(name=name, namespace=ns, body=body)
        print(f"Patched Deployment {ns}/{name}")

    def patch_statefulset(ns, name):
        body = {"spec": {"template": {"spec": {"hostIPC": False}}}}
        apps_v1.patch_namespaced_stateful_set(name=name, namespace=ns, body=body)
        print(f"Patched StatefulSet {ns}/{name}")

    def patch_daemonset(ns, name):
        body = {"spec": {"template": {"spec": {"hostIPC": False}}}}
        apps_v1.patch_namespaced_daemon_set(name=name, namespace=ns, body=body)
        print(f"Patched DaemonSet {ns}/{name}")

    def patch_pod(ns, name):
        body = {"spec": {"hostIPC": False}}
        core_v1.patch_namespaced_pod(name=name, namespace=ns, body=body)
        print(f"Patched Pod {ns}/{name}")

    def has_hostipc(pod_spec):
        return getattr(pod_spec, "host_ipc", False) is True

    for ns in namespaces:
        # Deployments
        for d in apps_v1.list_namespaced_deployment(ns).items:
            if has_hostipc(d.spec.template.spec):
                patch_deployment(ns, d.metadata.name)

        # StatefulSets
        for ss in apps_v1.list_namespaced_stateful_set(ns).items:
            if has_hostipc(ss.spec.template.spec):
                patch_statefulset(ns, ss.metadata.name)

        # DaemonSets
        for ds in apps_v1.list_namespaced_daemon_set(ns).items:
            if has_hostipc(ds.spec.template.spec):
                patch_daemonset(ns, ds.metadata.name)

        # Standalone Pods (note: they may be recreated by a controller)
        for p in core_v1.list_namespaced_pod(ns).items:
            # Skip pods managed by controllers; fix the controller instead
            if p.metadata.owner_references:
                continue
            if has_hostipc(p.spec):
                patch_pod(ns, p.metadata.name)

if __name__ == "__main__":
    patch_hostipc_false()

Run this, then verify:

kubectl get deploy,statefulset,daemonset,pod -A -o yaml | grep -n hostIPC

4. Optional: Enforce policy (prevent future hostIPC)​

In OKE you can use:

  • OPA Gatekeeper or Kyverno to deny workloads with hostIPC: true, e.g. a Gatekeeper ConstraintTemplate that rejects .spec.template.spec.hostIPC == true.

If you want, I can provide a ready-made Gatekeeper or Kyverno policy to enforce this in OKE.

Using Terraform

This setting cannot be controlled on the oci_containerengine_cluster resource itself. OKE does not expose a cluster‑level Terraform argument to block hostIPC: true; you must enforce this via Kubernetes admission controls (e.g., Pod Security Admission / Pod Security Policies for older versions, or OPA Gatekeeper constraints) applied inside the cluster using kubectl or a Kubernetes‑oriented Terraform provider, or via the OKE Console’s admission policy / security profile configuration.

terraform plan for the oci_containerengine_cluster resource alone will show no changes related to hostIPC because that knob is not available on this resource.