Minimize the admission of containers wishing to share the host IPC namespace

Méthode de vérification

Méthode d'audit: Commande shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{.metadata.namespace}} {{.metadata.name}} {{.spec.hostIPC}}{{"\n"}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && ($3=="true")')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Sortie attendue

compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Configure Pod Security Admission on workload namespaces so pods that request spec.hostIPC: true are denied at admission time. In current EKS guidance, the baseline Pod Security Standard prohibits hostIPC, restricted inherits that restriction, and AWS recommends using Pod Security Standards in EKS to limit risky pod settings through namespace-based enforcement. For remediation, use enforce because AWS documents that only enforce rejects violating pods. warn and audit can help during rollout, but they do not block admission. • Label each workload namespace to enforce restricted. kubectl label ns NAMESPACE pod-security.kubernetes.io/enforce=restricted --overwrite • Add warn and audit during transition if you want visibility into violations before or alongside enforcement.

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

tmaegis scan --target eks