Description

Detects when Kubernetes resources are configured to share the host's IPC (Inter-Process Communication) namespace by having hostIPC set to true. This is a security risk as it allows containers to potentially interfere with host processes and access sensitive information through shared memory.

Detection Strategy

• Examines Kubernetes resource definition files (like Pod, Deployment, StatefulSet specs)

• Looks for 'hostIPC: true' configuration in the spec section of container resources

• Reports a vulnerability when a container resource explicitly enables host IPC namespace sharing

Vulnerable code example

resource "kubernetes_cron_job_v1" "demo" {
  metadata {
    name = "demo-job"
  }
  spec {
    schedule = "*/5 * * * *"
    job_template {
      spec {...

✅ Secure code example

resource "kubernetes_cron_job_v1" "demo" {
  metadata {
    name = "demo-job"
  }
  spec {
    schedule = "*/5 * * * *"
    job_template {
      spec {...