Do not specify hostPort unless absolutely necessary
Error: hostPort is specified
Bridgecrew Policy ID: BC_K8S_25
Checkov Check ID: CKV_K8S_26
Severity: LOW
hostPort is specified
Description
The hostPort setting applies to the Kubernetes containers. The container port will be exposed to the external network at :, where the hostIP is the IP address of the Kubernetes node where the container is running, and the hostPort is the port requested by the user.
We recommend that you do not specify a hostPort for a pod unless it is absolutely necessary. When you bind a pod to a hostPort, it limits the number of places the pod can be scheduled, because each <hostIP, hostPort, protocol> combination must be unique.
Warning
If you do not specify the hostIP and protocol explicitly, Kubernetes will use 0.0.0.0 as the default hostIP and TCP as the default protocol. This will expose your host to the internet.
Fix - Buildtime
Kubernetes
- Resource: Container
- Argument: hostPort (Optional)
Defines the number of port to expose on the host.
apiVersion: v1
kind: Pod
metadata:
name: <Pod name>
spec:
containers:
- name: <container name>
image: <image>
ports:
- hostPort: <port>
Updated 10 months ago