1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-16 12:40:43 +00:00
kyverno/samples/DisallowHostNetworkPort.md

32 lines
737 B
Markdown
Raw Normal View History

2019-10-23 14:06:03 -07:00
# Disallow `hostNetwork` and `hostPort`
2019-10-23 15:36:37 -07:00
Using `hostPort` and `hostNetwork` allows pods to share the host networking stack allowing potential snooping of network traffic across application pods.
2019-10-23 14:06:03 -07:00
## Policy YAML
[disallow_host_network_port.yaml](best_practices/disallow_host_network_port.yaml)
2019-10-23 14:06:03 -07:00
````yaml
apiVersion: kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
name: disallow-host-network-port
2019-10-23 14:06:03 -07:00
spec:
rules:
- name: validate-host-network-port
2019-10-23 14:06:03 -07:00
match:
resources:
kinds:
- Pod
validate:
message: "Using host networking is not allowed"
2019-10-23 14:06:03 -07:00
pattern:
spec:
(hostNetwork): false
containers:
- name: "*"
ports:
- hostPort: null
````