Skip to main content

☑️ Ensure hostPath volume mounts are read-only

A hostPath volume mounts a file or directory from the host node's filesystem into a Pod.

By default pods that run as root will have write access to the file system exposed by hostPath. This could allow an attacker to modify the kubelet settings, create symbolic links to directories or files not directly exposed by the hostPath, install ssh keys, read secrets mounted to the host, and other malicious things.

Targeted objects by this rule (types of kind): Deployment / Pod / DaemonSet / StatefulSet / ReplicaSet / CronJob / Job

Complexity: easy (What does this mean?)

Policy as code identifier: EKS_INVALID_HOSTPATH_MOUNT_READONLY_VALUE


This rule will fail​

If a hostPath volume is mounted without being set as read-only:

spec:
volumes:
- name: mount-this
hostPath:
path: /cache
type: Directory
containers:
- volumeMounts:
- mountPath: /cache
name: mount-this

Rule output in the CLI​

$ datree test *.yaml

>> File: failExample.yaml
❌ Ensure hostPath volume mounts are read-only [1 occurrence]
💡 Invalid key `readOnly` - set to 'true' to prevent potential attacks on the host filesystem

How to fix this failure​

spec:
volumes:
- name: mount-this
hostPath:
path: /cache
type: Directory
containers:
- volumeMounts:
- mountPath: /cache
name: mount-this
readOnly: true

Read more​