Minimize The Admission Of Containers Sharing The Host Network Namespace

# 1) Create a baseline policy that denies hostNetwork by default
# Run on: any machine with kubectl access

cat << 'EOF' > deny-hostnetwork-admission.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: deny-hostnetwork
  annotations:
    policies.kyverno.io/title: Deny Host Network
    policies.kyverno.io/category: Security
    policies.kyverno.io/description: >-
      Block creation of Pods that set spec.hostNetwork=true.
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: deny-hostnetwork
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaces:
                - "*"
      exclude:
        any:
          - resources:
              namespaces:
                - kube-system
                - kube-public
                - kube-node-lease
      validate:
        message: "Use of hostNetwork is not allowed in this namespace."
        pattern:
          spec:
            =(hostNetwork): "false"
EOF

kubectl apply -f deny-hostnetwork-admission.yaml

# 2) (Optional) Namespace-specific policy allowing exceptions if needed
# Replace <namespace-with-user-workloads> with an actual namespace name

cat << 'EOF' > deny-hostnetwork-namespace.yaml
apiVersion: kyverno.io/v1
kind: Policy
metadata:
  name: deny-hostnetwork
  namespace: <namespace-with-user-workloads>
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: deny-hostnetwork-in-namespace
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Use of hostNetwork is not allowed in this namespace."
        pattern:
          spec:
            =(hostNetwork): "false"
EOF

# Apply for a specific namespace:
kubectl apply -f deny-hostnetwork-namespace.yaml

# 3) Clean up any existing hostNetwork pods in user namespaces if appropriate
# Review first:
kubectl get pods --all-namespaces -o json \
  | jq -r '.items[] | select(.spec.hostNetwork == true) | "\(.metadata.namespace) \(.metadata.name)"'

# After deciding which user workloads should be changed, edit or patch each Pod/Deployment/etc.
# Example for a Deployment in a user namespace:
kubectl -n <user-namespace> edit deployment <deployment-name>
# and manually remove or set:
#   hostNetwork: false
# under spec.template.spec

# 4) Verification (same logic as the audit)
# Run on: any machine with kubectl access

kubectl get pods --all-namespaces -o json \
  | jq -r 'if any(.items[]?; .spec.hostNetwork == true) then "HOSTNETWORK_FOUND" else "NO_HOSTNETWORK" end'

#!/usr/bin/env bash
set -euo pipefail

# Purpose:
# - For every non-system namespace, ensure a policy exists that denies pods
#   using hostNetwork.
# - Uses a Kyverno ClusterPolicy; idempotent and safe to re-run.
#
# Prerequisites:
# - Run on any machine with kubectl access and sufficient RBAC to create
#   cluster-wide policies (ClusterPolicy).

# 1) Check access
kubectl auth can-i create clusterpolicies.kyverno.io >/dev/null 2>&1 || {
  echo "ERROR: This script requires permission to create Kyverno ClusterPolicies." >&2
  exit 1
}

# 2) Ensure Kyverno is installed (simple presence check)
if ! kubectl get ns kyverno >/dev/null 2>&1; then
  echo "ERROR: Namespace 'kyverno' not found. Install Kyverno admission controller first." >&2
  exit 1
fi

# 3) Apply a ClusterPolicy that denies hostNetwork pods in all non-system namespaces
#    This single policy satisfies the requirement "Add policies to each namespace
#    in the cluster which has user workloads to restrict the admission of hostNetwork containers."
cat <<'EOF' | kubectl apply -f -
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: deny-hostnetwork-pods
  annotations:
    policies.kyverno.io/title: Deny hostNetwork Pods
    policies.kyverno.io/category: Security
    policies.kyverno.io/severity: high
    policies.kyverno.io/description: >
      Deny Pods that request hostNetwork in all non-system namespaces.
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: deny-hostnetwork
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaces:
                - "*"
      exclude:
        any:
          - resources:
              namespaces:
                - kube-system
                - kube-public
                - kube-node-lease
                - kyverno
              # Add any other infrastructure or system namespaces here if needed
      validate:
        message: "Use of hostNetwork is not allowed in this namespace."
        pattern:
          spec:
            hostNetwork: "false"
EOF

echo "ClusterPolicy 'deny-hostnetwork-pods' applied."

# 4) Verification

echo "Verifying policy existence..."
if ! kubectl get clusterpolicy deny-hostnetwork-pods -o yaml >/dev/null 2>&1; then
  echo "ERROR: ClusterPolicy 'deny-hostnetwork-pods' not found after apply." >&2
  exit 1
fi

echo "Verifying that new hostNetwork pods are rejected in a test namespace..."

# Create a temporary test namespace (non-system)
TEST_NS="hostnetwork-deny-test"
kubectl get ns "${TEST_NS}" >/dev/null 2>&1 || kubectl create ns "${TEST_NS}" >/dev/null

# Try to create a pod with hostNetwork: true (should be denied)
set +e
kubectl -n "${TEST_NS}" apply -f - <<'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: test-hostnetwork-denied
spec:
  hostNetwork: true
  containers:
    - name: pause
      image: registry.k8s.io/pause:3.9
EOF
APPLY_RC=$?
set -e

if [ "${APPLY_RC}" -eq 0 ]; then
  echo "ERROR: Test pod with hostNetwork was admitted; policy is not effective." >&2
  # Clean up in case it was actually created
  kubectl -n "${TEST_NS}" delete pod test-hostnetwork-denied --ignore-not-found >/dev/null 2>&1 || true
  exit 1
fi

echo "Policy enforcement verified: hostNetwork pod creation was rejected."

# 5) Final cluster-wide check for existing hostNetwork pods (informational)
echo "Current cluster state (existing pods may still use hostNetwork until recreated):"
kubectl get pods --all-namespaces -o json \
  | jq -r 'if any(.items[]?; .spec.hostNetwork == true) then "HOSTNETWORK_FOUND" else "NO_HOSTNETWORK" end'