1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-17 21:20:52 +00:00
kyverno/samples/DisallowHostNetworkPort.md
2019-10-23 14:45:27 -07:00

32 lines
No EOL
765 B
Markdown

# Disallow `hostNetwork` and `hostPort`
Using `hostPort` and `hostNetwork` allows pods to share the host network stack, allowing potential snooping of network traffic from an application pod.
## Policy YAML
[disallow_host_network_hostport.yaml](best_practices/disallow_host_network_hostport.yaml)
````yaml
apiVersion: kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
name: validate-host-network-hostport
spec:
rules:
- name: validate-host-network-hostport
match:
resources:
kinds:
- Pod
validate:
message: "Defining hostNetwork and hostPort are not allowed."
pattern:
spec:
(hostNetwork): false
containers:
- name: "*"
ports:
- hostPort: null
````