Do not specify hostPort unless absolutely necessary

Error: hostPort is specified

Bridgecrew Policy ID: BC_K8S_25
Checkov Check ID: CKV_K8S_26
Severity: LOW

hostPort is specified

Description

The hostPort setting applies to the Kubernetes containers. The container port will be exposed to the external network at :, where the hostIP is the IP address of the Kubernetes node where the container is running, and the hostPort is the port requested by the user.

We recommend that you do not specify a hostPort for a pod unless it is absolutely necessary. When you bind a pod to a hostPort, it limits the number of places the pod can be scheduled, because each <hostIP, hostPort, protocol> combination must be unique.

🚧

Warning

If you do not specify the hostIP and protocol explicitly, Kubernetes will use 0.0.0.0 as the default hostIP and TCP as the default protocol. This will expose your host to the internet.

Fix - Buildtime

Kubernetes

  • Resource: Container
  • Argument: hostPort (Optional)
    Defines the number of port to expose on the host.
apiVersion: v1
kind: Pod
metadata:
  name: <Pod name>
spec:
  containers:
  - name: <container name>
    image: <image>
    ports:
-    hostPort: <port>