k8spsphostnamespace

Basic Information

• Policy type: security
• Recommended level: L3
• Effective resource type: Pod
• Parameter: None

Function

The hostPID and hostIPC fields in PodSecurityPolicy are restricted.

Policy Example

The following policy instance shows the types of resources for which the policy definition takes effect.

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPHostNamespace
metadata:
  name: psp-host-namespace
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]

Resource Definition That Complies with the Policy

In the example, the values of hostPID and hostIPC are false, which complies with the policy instance.

apiVersion: v1
kind: Pod
metadata:
  name: nginx-host-namespace-allowed
  labels:
    app: nginx-host-namespace
spec:
  hostPID: false
  hostIPC: false
  containers:
  - name: nginx
    image: nginx

Resource Definition That Does Not Comply with the Policy

In the example, the values of hostPID and hostIPC are true, which does not comply with the policy instance.

apiVersion: v1
kind: Pod
metadata:
  name: nginx-host-namespace-disallowed
  labels:
    app: nginx-host-namespace
spec:
  hostPID: true
  hostIPC: true
  containers:
  - name: nginx
    image: nginx