Description

Detects Kubernetes configurations that enable hostProcess for Windows containers. When hostProcess is enabled, containers can access and interact with the host system directly, breaking container isolation and potentially allowing privilege escalation on Windows nodes.

Detection Strategy

• Review Kubernetes resource manifests (Pod, Deployment, etc) for container specifications

• Check if container configuration includes hostProcess setting enabled

• Flag configurations where hostProcess=true is found in Windows container specs

Vulnerable code example

resource "kubernetes_pod" "example" {
  metadata {
    name = "example-pod"
  }
  spec {
    security_context {
      windows_options {
        host_process = true  # Security risk: Enables Windows HostProcess containers which can access host resources...

✅ Secure code example

resource "kubernetes_pod" "example" {
  metadata {
    name = "example-pod"
  }
  spec {
    automount_service_account_token = false  # Prevent automatic mounting of service account tokens
    security_context {
      windows_options {...