In this lesson, you will learn how to harden your cluster by preventing pods from breaking out of their logical isolation and interacting directly with the host node's operating system.
The Concept of Host Namespaces
By default, Kubernetes pods run in their own isolated namespaces for networking, process IDs (PID), and Inter-Process Communication (IPC). However, Kubernetes allows these to be disabled, granting a pod visibility into the host node's resources. While sometimes necessary for system-level tools (like monitoring agents), granting this access to a standard application pod is a major security risk.
- Host Network: The pod shares the node’s network stack, allowing it to sniff traffic or bind to host ports.
- Host PID: The pod can see and potentially kill processes running on the host.
- Host IPC: The pod can access shared memory segments used by host processes.
If an attacker compromises a pod with these flags enabled, they effectively gain a foothold into the underlying host node, rendering container-level security controls irrelevant.
Restricting Access
In a secure cluster, you should explicitly disallow the use of these host namespaces in your Pod specifications. If you are configuring a Pod, ensure these fields are either set to false or omitted entirely (as they default to false):
apiVersion: v1
kind: Pod
metadata:
name: secure-app
spec:
hostNetwork: false
hostPID: false
hostIPC: false
containers:
- name: app
image: my-secure-image
To enforce this cluster-wide, you should use Pod Security Admission (PSA). By applying a "Restricted" or "Baseline" policy at the namespace level, the Kubernetes API server will automatically reject any Pod manifest that attempts to set these values to true. This creates a guardrail that prevents developers or automated deployments from accidentally (or maliciously) escalating their privileges to the host level.
Always audit your existing workloads using kubectl get pods -A -o yaml to search for these fields. If a pod requires these permissions, it should be isolated in a dedicated namespace with strict RBAC and limited node affinity to minimize the blast radius.
Key Takeaway: Never grant a pod access to the host’s network, PID, or IPC namespaces unless absolutely required for cluster-node management, as these bypass the core isolation guarantees of containerization.