Remove `hostPID: true` from the nodeplugin pod spec
- Dominant language
- Go
- Stars
- 1.6k
- Forks
- 617
- Avg merge
- 5d 10h
- Merged PRs (30d)
- 43
Description
I have a critical warning in my local playground cluster that reads like the following:
Sharing the host PID namespace lets the container see and signal all host processes, enabling process injection attacks.
K8s: Pod Security Standards
NSA/CISA Kubernetes Hardening Guide
DAEMONSET
rook-ceph / rook-ceph.rbd.csi.ceph.com-nodeplugin
Rook-Ceph version (Operator and Cluster): 1.19.7
For reference: I first opened it up here: https://github.com/rook/rook/issues/18032#issuecomment-5089145863
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the nodeplugin pod spec and its DaemonSet configuration, then inspect where hostPID is set. Confirm that removing it does not disrupt nodeplugin operation; done means the nodeplugin pod spec no longer enables the host PID namespace.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100