Description

Detects when Kubernetes configurations enable host PID namespace sharing (hostPID: true), which allows containers to see and potentially interact with processes running on the host system. This breaks container isolation and can lead to privilege escalation or information disclosure vulnerabilities.

Detection Strategy

• Scans Kubernetes resource configuration files (like Pod, Deployment, StatefulSet specs)

• Identifies resource specifications that contain container configurations

• Checks if 'hostPID' attribute is explicitly set to true in the spec section

• Reports a vulnerability when containers are configured to share the host's PID namespace

Vulnerable code example

resource "kubernetes_pod" "vulnerable_pod" {
  metadata {
    name = "vulnerable-pod"
  }
  spec {
    host_pid = true  # Security risk: Allows pod to access host PID namespace
    container {
      name  = "nginx"...

✅ Secure code example

resource "kubernetes_pod" "secure_pod" {
  metadata {
    name = "secure-pod"
    labels = {
      app = "web"
    }
  }
  spec {...