Kubernetes Security: hostPort opens the node’s port

This page describes a highlighted problem produced by the Docker and Kubernetes Security scanner plugin.

You could find more details on the internal page: Cloud (IaC) Security plugin

If this project has been helpful to you, please consider giving it a ⭐ on GitHub to help others discover it.

What’s wrong with hostPort?

The hostPort opens the node’s port directly to external traffic, bypassing cluster-level network controls and creating significant Kubernetes security vulnerabilities.

Description

The Kubernetes hostPort configuration maps a container port directly onto the node’s primary IP address, skipping Kubernetes’ built-in security architecture. This direct mapping means that network traffic reaches the pod before traversing Kubernetes Services or potentially bypassing NetworkPolicy enforcement, transforming what should be an isolated, cluster-internal component into a dangerous node-level exposure.

By defining hostPort, you make a hole through the cluster’s network perimeter. Instead of remaining isolated behind a Service abstraction, the container listens for incoming connections directly on the host’s interface. The hostPort violates the defense-in-depth principle that foundament Kubernetes security best practices.

Solution

Remove the hostPort definition entirely and replace it with appropriate Kubernetes security-compliant alternatives like Services or Ingress controllers. These alternatives maintain the security boundaries that Kubernetes host port bypasses while providing the necessary network connectivity.

Problematic code

apiVersion: v1
kind: Pod
metadata:
  name: influxdb
spec:
  containers:
    - name: influxdb
      image: influxdb
      ports:
        - containerPort: 8086
          hostPort: 8086

Verified code

apiVersion: v1
kind: Pod
metadata:
  name: influxdb
spec:
  containers:
    - name: influxdb
      image: influxdb

Source of the description: Pod Security Standards