Minimize the admission of containers wishing to share the host IPC namespace

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

out=$(kubectl get pods -A -o go-template='{{range .items}}{{.metadata.namespace}} {{.metadata.name}} {{.spec.hostIPC}}{{"\n"}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && ($3=="true")')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Beklenen çıktı

compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Configure Pod Security Admission on workload namespaces so pods that request spec.hostIPC: true are denied at admission time. In current EKS guidance, the baseline Pod Security Standard prohibits hostIPC, restricted inherits that restriction, and AWS recommends using Pod Security Standards in EKS to limit risky pod settings through namespace-based enforcement. For remediation, use enforce because AWS documents that only enforce rejects violating pods. warn and audit can help during rollout, but they do not block admission. • Label each workload namespace to enforce restricted. kubectl label ns NAMESPACE pod-security.kubernetes.io/enforce=restricted --overwrite • Add warn and audit during transition if you want visibility into violations before or alongside enforcement.

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

tmaegis scan --target eks