Skip to main content

☑️ Prevent containers from insecurely exposing workload

Workloads listen on a private IP address and receive network traffic from the rest of the network by default. To be reachable outside of the cluster, you must explicitly add an ingress controller or a load balancer service, then route traffic to the workload. hostPort is a setting used to bind the private IP to the underlying IP.

With the hostPort defined, the workloads become exposed as the node, but without the firewall rules and access control attached to the host.

Targeted resources by this rule (types of kind): Deployment / Pod / DaemonSet / StatefulSet / ReplicaSet / CronJob / Job

Enabled by default? True

Policy as code identifier: CONTAINERS_INCORRECT_KEY_HOSTPORT


This rule will fail

If the hostPort key is set:

kind: Pod
spec:
containers:
- name: myContainer
- hostPort: 8080

Rule output in the CLI

$ datree test *.yaml

>> File: failExample.yaml
❌ Prevent containers from insecurely exposing workload [1 occurrence]
💡 Incorrect key `hostPort` - refrain from using this key to prevent insecurely exposing your workload

How to fix this failure

Refrain from using the hostPort key (use NodePort or ClusterIP instead).

kind: Service
spec:
type: NodePort

Read more