k8spsphostnetworkingports

Basic Information

• Policy type: security
• Recommended level: L3
• Effective resource type: Pod
• Parameter

  exemptImages: String array
  hostNetwork: 
    max: Integer
    min: Integer

Function

The hostNetwork and hostPorts fields in PodSecurityPolicy are restricted.

Policy Example

The following policy instance shows the types of resources for which the policy definition takes effect. If hostNetwork in parameters is set to true, the used port must be within the specified port range.

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPHostNetworkingPorts
metadata:
  name: psp-host-network-ports
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    hostNetwork: bool
    min: 80
    max: 9000

Resource Definition That Complies with the Policy

In the example, hostNetwork is set to false, which complies with the policy instance.

apiVersion: v1
kind: Pod
metadata:
  name: nginx-host-networking-ports-allowed
  labels:
    app: nginx-host-networking-ports
spec:
  hostNetwork: false
  containers:
  - name: nginx
    image: nginx
    ports:
    - containerPort: 9000
      hostPort: 80

Resource Definition That Does Not Comply with the Policy

In the example, hostNetwork is set to true, but the port number is not in the specified range, which does not comply with the policy instance.

apiVersion: v1
kind: Pod
metadata:
  name: nginx-host-networking-ports-disallowed
  labels:
    app: nginx-host-networking-ports
spec:
  hostNetwork: true
  containers:
  - name: nginx
    image: nginx
    ports:
    - containerPort: 9001
      hostPort: 9001