Skip to main content

OCI OKE Should Minimize Containers Sharing the Host Network

More Info:​

hostNetwork=true gives a pod direct access to node interfaces, bypassing NetworkPolicy and potentially exposing kubelet, kube-proxy, and other host services. Restrict this to system add-ons that genuinely require it.

Risk Level​

High

Address​

Compliance, Security

Compliance Standards​

  • CIS OKE

Triage and Remediation​

Remediation​

Using Console

To remediate “OCI OKE should minimize containers sharing the host network namespace” using the OCI Console, you need to:

  1. Identify workloads using hostNetwork
  1. Sign in to the OCI Console.
  2. In the left menu, go to Developer Services → Containers & Artifacts → Kubernetes Clusters (OKE).
  3. Click your cluster.
  4. In the cluster detail page, click Workloads.
  5. For each Deployment / StatefulSet / DaemonSet / Pod:
    • Open the workload.
    • Click YAML (or Edit YAML / View YAML, depending on the console version).
    • Look for: 
      spec:
        hostNetwork: true
    • Also check container ports for hostPort values (often appear with hostNetwork).

Any workload with hostNetwork: true is sharing the host network namespace.

  1. Edit workloads to stop using the host network

For each offending workload you found:

  1. In Workloads, click the workload (e.g., a Deployment).
  2. Click Edit YAML.
  3. In the pod spec, change or remove: 
    spec:
      hostNetwork: true
    to either: 
    spec:
      hostNetwork: false
    or remove the hostNetwork line entirely (default is false).
  4. If possible, also remove any hostPort mappings under containers: 
    containers:
    - name: <container-name>
      ports:
      - containerPort: 8080
        hostPort: 8080      # remove this if not strictly required
  5. Click Save / Update to apply the changes.
  6. The Deployment/StatefulSet/DaemonSet will roll out new pods without hostNetwork.

Repeat for all workloads using hostNetwork: true.

  1. (Optional but recommended) Enforce a policy to prevent future use

OKE does not yet provide a native “checkbox” to forbid hostNetwork, but you can enforce via Kubernetes policy tools (e.g., Gatekeeper/OPA) deployed to your cluster. From the OCI Console you:

  1. Go to your OKE cluster → Access Cluster → use the Cloud Shell or local kubectl.
  2. Deploy an admission policy that denies pods with spec.hostNetwork: true.

Example Gatekeeper ConstraintTemplate and Constraint would enforce this at cluster level. (This is done via kubectl apply rather than GUI, but initiated from the Console via Cloud Shell.)

  1. Verify remediation
  1. In the Workloads view, re-open the YAML for each previously offending workload.
  2. Confirm:
    • hostNetwork is not present, or explicitly set to false.
    • hostPort is removed where not necessary.
  3. Optionally, use:
    • Cloud Guard (if enabled) → check your target/recipe to ensure the detector for host network sharing is now green/not triggering for the cluster.

This removes container sharing of the host network namespace for your OKE workloads via changes made through the OCI Console.

Using CLI

In OKE this setting is controlled in the Pod spec (hostNetwork: true), so the remediation is to update workloads so they no longer request the host network. OCI CLI is only for cluster/infra management, so you use it to get kubeconfig, then use kubectl against the cluster.

1. Get kubeconfig for the OKE cluster using OCI CLI​

# Replace these with your values
COMPARTMENT_OCID="<compartment_ocid>"
CLUSTER_OCID="<cluster_ocid>"
KUBECONFIG_PATH="$HOME/.kube/config-oke"

oci ce cluster create-kubeconfig \
  --cluster-id "$CLUSTER_OCID" \
  --file "$KUBECONFIG_PATH" \
  --region "<region-identifier>" \
  --token-version 2.0.0 \
  --kube-endpoint PUBLIC_ENDPOINT

export KUBECONFIG="$KUBECONFIG_PATH"

2. Find Pods using hostNetwork: true​

kubectl get pods -A -o jsonpath='{range .items[?(@.spec.hostNetwork==true)]}{.metadata.namespace}{"\t"}{.metadata.name}{"\n"}{end}'

If you want to find the owning controllers (Deployments/DaemonSets/StatefulSets):

kubectl get pods -A -o json | jq -r '
  .items[]
  | select(.spec.hostNetwork == true)
  | "\(.metadata.namespace)\t\(.metadata.name)\t\(.metadata.ownerReferences[0].kind)\t\(.metadata.ownerReferences[0].name)"'

3. Update the owning resources to stop using host networking​

For each Deployment/DaemonSet/StatefulSet that uses hostNetwork: true, remove or set it to false.

Example – patch a Deployment:

NAMESPACE="<ns>"
DEPLOYMENT_NAME="<deploy-name>"

kubectl -n "$NAMESPACE" patch deployment "$DEPLOYMENT_NAME" \
  --type='json' \
  -p='[
    {"op":"remove","path":"/spec/template/spec/hostNetwork"}
  ]'

If the field must exist and be explicit:

kubectl -n "$NAMESPACE" patch deployment "$DEPLOYMENT_NAME" \
  --type='merge' \
  -p='{"spec":{"template":{"spec":{"hostNetwork":false}}}}'

Repeat similarly for DaemonSets/StatefulSets, changing the resource kind:

kubectl -n "$NAMESPACE" patch daemonset "$DAEMONSET_NAME" ...
kubectl -n "$NAMESPACE" patch statefulset "$STS_NAME" ...

Note: If containers were binding to host ports (hostPort), you must reconfigure them to use ClusterIP/NodePort/LoadBalancer Services instead.

4. (Optional) Enforce policy so new Pods can’t use hostNetwork​

You can use Admission Control / Pod Security Standards (if enabled in your OKE version) or a policy engine like Gatekeeper. A simple starting point is to apply a PodSecurity admission config or a Gatekeeper constraint that denies Pods with spec.hostNetwork: true. That’s done with kubectl apply -f <policy.yaml> after preparing the policy YAML; OCI CLI itself does not control that per‑Pod setting.

Using Python

In OKE this is a standard Kubernetes setting: containers use the host network when the Pod spec has hostNetwork: true. To “minimize” it, you must:

  1. Find workloads using hostNetwork: true.
  2. Update their specs to hostNetwork: false (or remove the field).
  3. Optionally enforce a policy so it can’t be reintroduced.

Below is how to do this programmatically in Python using the Kubernetes Python client against your OKE cluster.

1. Prerequisites​

pip install kubernetes

Make sure your kubeconfig for the OKE cluster is set (e.g. created via OCI CLI) and that kubectl get pods works.

2. Python: Detect Pods Using hostNetwork: true​

This script lists all pods in all namespaces that have hostNetwork enabled:

from kubernetes import client, config

def main():
    # Load kubeconfig (for OKE cluster)
    config.load_kube_config()  # or config.load_incluster_config() if running inside cluster

    v1 = client.CoreV1Api()

    pods = v1.list_pod_for_all_namespaces(watch=False)
    print("Pods using hostNetwork:")
    for pod in pods.items:
        if pod.spec.host_network:
            print(f"{pod.metadata.namespace}/{pod.metadata.name}")

if __name__ == "__main__":
    main()

3. Python: Identify Higher-Level Controllers Using hostNetwork​

Usually you don’t patch pods directly; you patch Deployments/DaemonSets/StatefulSets/Jobs that create them.

Example to scan Deployments and DaemonSets:

from kubernetes import client, config

def main():
    config.load_kube_config()
    apps_v1 = client.AppsV1Api()

    print("Deployments using hostNetwork:")
    deps = apps_v1.list_deployment_for_all_namespaces()
    for d in deps.items:
        if d.spec.template.spec.host_network:
            print(f"Deployment: {d.metadata.namespace}/{d.metadata.name}")

    print("\nDaemonSets using hostNetwork:")
    dss = apps_v1.list_daemon_set_for_all_namespaces()
    for ds in dss.items:
        if ds.spec.template.spec.host_network:
            print(f"DaemonSet: {ds.metadata.namespace}/{ds.metadata.name}")

if __name__ == "__main__":
    main()

4. Python: Patch Workloads to Disable hostNetwork​

This will set hostNetwork: false for Deployments and DaemonSets that currently use it.

from kubernetes import client, config

def disable_host_network_deployments():
    config.load_kube_config()
    apps_v1 = client.AppsV1Api()

    deps = apps_v1.list_deployment_for_all_namespaces()
    for d in deps.items:
        if d.spec.template.spec.host_network:
            ns = d.metadata.namespace
            name = d.metadata.name
            print(f"Patching Deployment {ns}/{name}: hostNetwork -> false")

            patch_body = {
                "spec": {
                    "template": {
                        "spec": {
                            "hostNetwork": False
                        }
                    }
                }
            }

            apps_v1.patch_namespaced_deployment(
                name=name,
                namespace=ns,
                body=patch_body
            )

def disable_host_network_daemonsets():
    config.load_kube_config()
    apps_v1 = client.AppsV1Api()

    dss = apps_v1.list_daemon_set_for_all_namespaces()
    for ds in dss.items:
        if ds.spec.template.spec.host_network:
            ns = ds.metadata.namespace
            name = ds.metadata.name
            print(f"Patching DaemonSet {ns}/{name}: hostNetwork -> false")

            patch_body = {
                "spec": {
                    "template": {
                        "spec": {
                            "hostNetwork": False
                        }
                    }
                }
            }

            apps_v1.patch_namespaced_daemon_set(
                name=name,
                namespace=ns,
                body=patch_body
            )

if __name__ == "__main__":
    disable_host_network_deployments()
    disable_host_network_daemonsets()

Notes:

  • This will trigger rolling updates; pods will be recreated without host networking.
  • Only run this on workloads where host networking is not required (e.g., not node-level agents).

5. Optional: Enforce No hostNetwork via Admission Control (Python + OPA Gatekeeper)​

In OKE you can deploy OPA Gatekeeper or Kyverno. With Gatekeeper, you would:

  1. Install Gatekeeper in the OKE cluster.
  2. Apply a ConstraintTemplate that denies hostNetwork: true.
  3. Apply a Constraint that targets your namespaces.

The actual Gatekeeper policy is YAML, but you can apply it via Python:

from kubernetes import client, config

GATEKEEPER_TEMPLATE = """
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8snohostnetwork
spec:
  crd:
    spec:
      names:
        kind: K8sNoHostNetwork
  targets:
  - target: admission.k8s.gatekeeper.sh
    rego: |
      package k8snohostnetwork

      violation[{"msg": msg}] {
        input.review.kind.kind == "Pod"
        input.review.object.spec.hostNetwork == true
        msg := "hostNetwork must not be true"
      }
"""

GATEKEEPER_CONSTRAINT = """
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sNoHostNetwork
metadata:
  name: disallow-hostnetwork
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Pod"]
    namespaces:
    - default
    - your-app-namespace
"""

def apply_yaml(yaml_str):
    from kubernetes.utils import create_from_yaml
    config.load_kube_config()
    k8s_client = client.ApiClient()
    create_from_yaml(k8s_client, yaml_objects=[yaml_str])

if __name__ == "__main__":
    apply_yaml(GATEKEEPER_TEMPLATE)
    apply_yaml(GATEKEEPER_CONSTRAINT)

(Adjust namespaces and ensure Gatekeeper is already installed.)

Summary​

  • Use the Kubernetes Python client against your OKE cluster.
  • Enumerate and patch any workloads whose Pod templates have hostNetwork: true.
  • Optionally deploy an admission policy (Gatekeeper or Kyverno) to prevent future hostNetwork usage.
Using Terraform
# This finding cannot be remediated on the OKE *cluster* Terraform resource itself.
# The `oci_containerengine_cluster` (or equivalent) resource has no argument that
# controls whether Pods use `hostNetwork`; that setting lives only in the Pod spec.

# To fix this with Terraform you must change the Kubernetes workload manifests
# (or Helm values) that Terraform applies, ensuring `hostNetwork` is not set or is false.

# Example for a Pod/Deployment managed via the Kubernetes provider:

resource "kubernetes_deployment_v1" "APP_DEPLOYMENT" {
  metadata {
    name      = "APP_NAME"          # substitute: your app name
    namespace = "APP_NAMESPACE"     # substitute: your namespace
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        app = "APP_NAME"            # substitute: label matching the pod template
      }
    }

    template {
      metadata {
        labels = {
          app = "APP_NAME"
        }
      }

      spec {
        # Ensure hostNetwork is NOT true (omit it, or set explicitly to false)
        host_network = false

        container {
          name  = "APP_CONTAINER_NAME"   # substitute: your container name
          image = "APP_IMAGE"            # substitute: your container image
        }
      }
    }
  }
}

The OCI OKE “cluster” resource cannot enforce hostNetwork usage; you must remediate by updating Kubernetes manifests (Deployments, DaemonSets, Pods, Helm charts) so spec.hostNetwork is not set to true, and then re-apply via Terraform. This change does not recreate the cluster, only the affected workloads. After changes, terraform plan should show updates to the specific Kubernetes workload resources where host_network is being changed.