Minimize the admission of containers wishing to share the host IPC namespace

Cara pemeriksaan

Metode audit: Perintah shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{.metadata.namespace}} {{.metadata.name}} {{.spec.hostIPC}}{{"\n"}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && ($3=="true")')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Output yang diharapkan

compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Configure Pod Security Admission on workload namespaces so pods that request spec.hostIPC: true are denied at admission time. In current EKS guidance, the baseline Pod Security Standard prohibits hostIPC, restricted inherits that restriction, and AWS recommends using Pod Security Standards in EKS to limit risky pod settings through namespace-based enforcement. For remediation, use enforce because AWS documents that only enforce rejects violating pods. warn and audit can help during rollout, but they do not block admission. • Label each workload namespace to enforce restricted. kubectl label ns NAMESPACE pod-security.kubernetes.io/enforce=restricted --overwrite • Add warn and audit during transition if you want visibility into violations before or alongside enforcement.

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

tmaegis scan --target eks