Pods Should Not Mount HostPath Volumes

Manual Steps

On any machine with kubectl access, list all non-system pods using hostPath and identify owners (Deployments, DaemonSets, etc.):

kubectl get pods --all-namespaces -o json | jq -r '
  [ .items[]
  | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | ([ ($m.ownerReferences // [])[] | select(.controller) ] | first) as $own
  | [ (.spec.volumes // [])[] | select(.hostPath != null) ] as $hp
  | select(($hp | length) > 0)
  | "\($m.namespace) \($m.name) \($own.kind)//\($own.name)//\($own.uid)" ][]'

For each affected pod, get the full manifest of its controller (example for a Deployment; run on any machine with kubectl access):
# Replace NAMESPACE and DEPLOYMENT_NAME from step 1 output kubectl -n NAMESPACE get deploy DEPLOYMENT_NAME -o yaml > /tmp/DEPLOYMENT_NAME.yaml
For other controllers, change deploy to statefulset, daemonset, job, or cronjob as appropriate.
Edit the saved manifest to remove hostPath volumes and references (any machine with kubectl access):
- Open the file:
  vi /tmp/DEPLOYMENT_NAME.yaml
- Under spec.template.spec.volumes, delete any entries containing hostPath:, including the path field.
- Under spec.template.spec.containers[].volumeMounts, delete mounts that reference the removed volume names.
- Optionally add safer replacements such as emptyDir: {} or PVC-backed volumes according to your application’s storage requirements.
Apply the updated manifest (any machine with kubectl access):
kubectl apply -f /tmp/DEPLOYMENT_NAME.yaml
Confirm old pods are being replaced and new pods are running:
kubectl -n NAMESPACE get pods -l app=APP_LABEL

For any stand-alone Pod objects (no controller ownerReference), edit them in place to remove hostPath (any machine with kubectl access):

kubectl -n NAMESPACE get pod POD_NAME -o yaml > /tmp/POD_NAME.yaml
vi /tmp/POD_NAME.yaml
# Remove hostPath entries and related volumeMounts as in step 3
kubectl delete pod -n NAMESPACE POD_NAME
kubectl apply -f /tmp/POD_NAME.yaml

Verify no non-system pods use hostPath (any machine with kubectl access):

kubectl get pods --all-namespaces -o json | jq -r '
  [ .items[]
  | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | [ (.spec.volumes // [])[] | select(.hostPath != null) ] as $hp
  | select(($hp | length) > 0)
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

Compliance is achieved when the output is exactly:
is_compliant=true

Using kubectl

On any machine with kubectl access:

Identify the offending pod and workload

kubectl get pods --all-namespaces \
  -o wide

Find the namespace and pod reported in the finding, then see what owns it:

kubectl -n NAMESPACE get pod POD_NAME -o jsonpath='{.metadata.ownerReferences}'

If ownerReferences is empty: it’s a naked Pod; you will edit/recreate the Pod.
If it shows a controller (Deployment, StatefulSet, DaemonSet, etc.): you will edit that controller, not the pod.

Export the current spec

For a naked Pod (no controller):

kubectl -n NAMESPACE get pod POD_NAME -o yaml > pod-fixed.yaml

For a controller (example: Deployment; adjust kind/name as needed):

kubectl -n NAMESPACE get deployment DEPLOYMENT_NAME -o yaml > deploy-fixed.yaml

Edit the manifest to remove hostPath

Open the saved YAML file and in the pod template:

Under spec.volumes, delete any entries that contain hostPath:.
Under each container’s volumeMounts, delete mounts that refer to those deleted volumes.

Example of what to remove:

spec:
  volumes:
    - name: host-logs
      hostPath:
        path: /var/log
        type: Directory

And its mount:

containers:
  - name: app
    volumeMounts:
      - name: host-logs
        mountPath: /var/log/host

If storage is still needed, replace with one of:

emptyDir:

volumes:
  - name: app-data
    emptyDir: {}

A PersistentVolumeClaim (assuming it already exists):

volumes:
  - name: app-data
    persistentVolumeClaim:
      claimName: EXISTING_PVC_NAME

Then mount app-data instead of the hostPath volume in volumeMounts.

Apply the updated manifest

For a naked Pod, delete and recreate (Pods cannot be updated in place):

kubectl -n NAMESPACE delete pod POD_NAME
kubectl apply -f pod-fixed.yaml

For a controller (example: Deployment):

kubectl apply -f deploy-fixed.yaml

Kubernetes will roll out new pods without the hostPath volumes.

Verification

On any machine with kubectl access, rerun:

kubectl get pods --all-namespaces -o json | jq -r '
  [ .items[]
  | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | (.spec.nodeName // "") as $node
  | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
  | ([ ($m.ownerReferences // [])[] | select(.controller) ] | first) as $own
  | [ (.spec.volumes // [])[] | select(.hostPath != null) ] as $hp
  | "kind=Pod ns=\($m.namespace) name=\($m.name) uid=\($m.uid) apiVersion=v1"
    + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
    + (if $node   == ""   then "" else " node=\($node)" end)
    + (if $labels == ""   then "" else " labels=\($labels)" end)
    + (if $own    == null then "" else " owner=\($own.kind)/\($m.namespace)/\($own.name)/\($own.uid)" end)
    + (if ($hp | length) == 0 then "" else " hostPaths=\([ $hp[] | .hostPath.path ] | join("+"))" end)
    + " is_compliant=\(if ($hp | length) > 0 then "false" else "true" end)"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

Automation

#!/usr/bin/env bash
#
# Remediation for: Pods Should Not Mount hostPath Volumes (CBP C1.7)
# Scope: Any machine with kubectl access to the OKE cluster
#
# Strategy:
# - Find all non-system Pods that use hostPath volumes
# - For Pods that are part of a controller (Deployment/DaemonSet/StatefulSet/Job/CronJob/ReplicaSet/ReplicationController),
#   remove hostPath volumes from the controller spec.
# - For naked Pods, warn and optionally delete (cannot safely auto-recreate).
# - Verify that no remaining Pods use hostPath volumes.
#
# Requirements:
# - kubectl configured with cluster-admin (or equivalent) access
# - jq available in PATH
# - bash 4+

set -euo pipefail

# --------- Helpers ---------

need_bin() {
  if ! command -v "$1" >/dev/null 2>&1; then
    echo "ERROR: Required binary '$1' not found in PATH" >&2
    exit 1
  fi
}

need_bin kubectl
need_bin jq

KUBECTL_CONTEXT="${KUBECTL_CONTEXT:-}"

kc() {
  if [[ -n "${KUBECTL_CONTEXT}" ]]; then
    kubectl --context "${KUBECTL_CONTEXT}" "$@"
  else
    kubectl "$@"
  fi
}

echo "Using kubectl context:"
kc config current-context

# Ensure we can talk to the cluster
kc get ns >/dev/null

# Namespaces excluded from the check (per audit command)
EXCLUDED_NS_REGEX='^(kube-system|kube-public|kube-node-lease)$'

timestamp() {
  date -u +"%Y%m%dT%H%M%SZ"
}

backup_dir="./hostpath-controller-backups-$(timestamp)"
mkdir -p "${backup_dir}"

# --------- Discovery ---------

echo "Discovering Pods with hostPath volumes (excluding kube-system, kube-public, kube-node-lease)..."

# Get detailed JSON for pods with hostPath and not in excluded namespaces
PODS_JSON="$(kc get pods --all-namespaces -o json)"

AFFECTED_PODS_JSON="$(
  echo "${PODS_JSON}" | jq '
    .items[]
    | select(.metadata.namespace | test("'"${EXCLUDED_NS_REGEX}"'") | not)
    | (.spec.volumes // []) as $vols
    | select([ $vols[]? | select(.hostPath != null) ] | length > 0)
  '
)"

if [[ -z "${AFFECTED_PODS_JSON}" ]]; then
  echo "No pods with hostPath volumes found outside excluded namespaces."
  exit 0
fi

# --------- Process each affected Pod ---------

echo "Processing affected pods..."

# We iterate pod by pod
echo "${AFFECTED_PODS_JSON}" | jq -c '.' | while read -r POD; do
  NS="$(echo "${POD}" | jq -r '.metadata.namespace')"
  NAME="$(echo "${POD}" | jq -r '.metadata.name')"

  # Extract controller ownerReference (if any)
  OWNER_JSON="$(echo "${POD}" | jq -c '[.metadata.ownerReferences // [] | .[] | select(.controller == true)] | first // empty')"

  if [[ -z "${OWNER_JSON}" || "${OWNER_JSON}" == "null" ]]; then
    echo "WARN: Pod ${NS}/${NAME} is a naked Pod using hostPath. Automation will NOT modify naked Pods."
    echo "      Consider: kubectl delete pod -n ${NS} ${NAME} after creating a replacement without hostPath."
    continue
  fi

  OWNER_KIND="$(echo "${OWNER_JSON}" | jq -r '.kind')"
  OWNER_NAME="$(echo "${OWNER_JSON}" | jq -r '.name')"
  OWNER_UID="$(echo "${OWNER_JSON}" | jq -r '.uid')"

  echo "Found controller-managed Pod: ${NS}/${NAME} owned by ${OWNER_KIND}/${OWNER_NAME}"

  # Map ReplicaSet/ReplicationController back to top-level controller when possible
  TARGET_KIND="${OWNER_KIND}"
  TARGET_NAME="${OWNER_NAME}"
  TARGET_NS="${NS}"

  case "${OWNER_KIND}" in
    ReplicaSet)
      # Attempt to find owning Deployment
      RS_JSON="$(kc -n "${NS}" get replicaset "${OWNER_NAME}" -o json || true)"
      if [[ -n "${RS_JSON}" ]]; then
        DEPLOY_OWNER="$(echo "${RS_JSON}" | jq -c '[.metadata.ownerReferences // [] | .[] | select(.controller == true and .kind == "Deployment")] | first // empty')"
        if [[ -n "${DEPLOY_OWNER}" && "${DEPLOY_OWNER}" != "null" ]]; then
          TARGET_KIND="Deployment"
          TARGET_NAME="$(echo "${DEPLOY_OWNER}" | jq -r '.name')"
        fi
      fi
      ;;
    Job)
      # Attempt to find owning CronJob
      JOB_JSON="$(kc -n "${NS}" get job "${OWNER_NAME}" -o json || true)"
      if [[ -n "${JOB_JSON}" ]]; then
        CJ_OWNER="$(echo "${JOB_JSON}" | jq -c '[.metadata.ownerReferences // [] | .[] | select(.controller == true and .kind == "CronJob")] | first // empty')"
        if [[ -n "${CJ_OWNER}" && "${CJ_OWNER}" != "null" ]]; then
          TARGET_KIND="CronJob"
          TARGET_NAME="$(echo "${CJ_OWNER}" | jq -r '.name')"
        fi
      fi
      ;;
    *)
      # DaemonSet, StatefulSet, Deployment, CronJob, ReplicationController, etc.
      :
      ;;
  esac

  echo "  Target controller to patch: ${TARGET_KIND}/${TARGET_NS}/${TARGET_NAME}"

  # Fetch controller manifest
  CONTROLLER_FILE="${backup_dir}/${TARGET_NS}_${TARGET_KIND}_${TARGET_NAME}.yaml"

  if [[ ! -f "${CONTROLLER_FILE}" ]]; then
    echo "  Backing up existing controller manifest to ${CONTROLLER_FILE}"
    if ! kc -n "${TARGET_NS}" get "${TARGET_KIND,,}.${TARGET_NS}/${TARGET_NAME}" >/dev/null 2>&1; then
      # Fallback to kubectl get KIND NAME form (most common)
      kc -n "${TARGET_NS}" get "${TARGET_KIND}" "${TARGET_NAME}" -o yaml > "${CONTROLLER_FILE}"
    else
      kc get "${TARGET_KIND,,}.${TARGET_NS}/${TARGET_NAME}" -o yaml > "${CONTROLLER_FILE}"
    fi
  else
    echo "  Backup already exists: ${CONTROLLER_FILE}"
  fi

  # Generate patched manifest with hostPath removed from pod template
  PATCHED_FILE="${backup_dir}/${TARGET_NS}_${TARGET_KIND}_${TARGET_NAME}_patched.yaml"

  echo "  Generating patched manifest (removing hostPath volumes from pod template)..."

  # Use jq to strip hostPath volumes and volumeMounts referencing them from pod template
  # NOTE: This is best-effort; manual review of ${PATCHED_FILE} is strongly recommended.
  kc -n "${TARGET_NS}" get "${TARGET_KIND}" "${TARGET_NAME}" -o json | jq '
    # work with .spec.template.spec
    ( .spec.template.spec ) as $spec
    | (
        $spec.volumes // []
        | map(select(.hostPath == null))
      ) as $cleanVolumes
    | $spec.containers as $containers
    | $containers as $origContainers
    | $origContainers
      | map(
          . as $c
          | .volumeMounts = (
              ($c.volumeMounts // [])
              | map(select(.name as $vn | ($cleanVolumes | map(.name) | index($vn)) != null))
            )
        ) as $cleanContainers
    | $spec.initContainers as $initContainers
    | $initContainers as $origInitContainers
    | $origInitContainers
      | map(
          . as $c
          | .volumeMounts = (
              ($c.volumeMounts // [])
              | map(select(.name as $vn | ($cleanVolumes | map(.name) | index($vn)) != null))
            )
        ) as $cleanInitContainers
    | .spec.template.spec.volumes = $cleanVolumes
    | if ($cleanContainers | length) > 0 then
        .spec.template.spec.containers = $cleanContainers
      else
        .
      end
    | if ($cleanInitContainers | length) > 0 then
        .spec.template.spec.initContainers = $cleanInitContainers
      else
        .
      end
  ' > "${PATCHED_FILE}"

  echo "  Applying patched manifest for ${TARGET_KIND}/${TARGET_NS}/${TARGET_NAME}..."
  kc -n "${TARGET_NS}" apply -f "${PATCHED_FILE}"

  echo "  Controller patched. Pods will be recreated without hostPath volumes (if possible)."

done

# --------- Verification ---------

echo "Waiting 10 seconds for controllers to reconcile..."
sleep 10

echo "Verifying that no remaining pods use hostPath volumes (excluding kube-system, kube-public, kube-node-lease)..."

VERIFY_OUTPUT="$(
  kc get pods --all-namespaces -o json | jq -r '
    [ .items[]
    | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
    | .metadata as $m
    | (.spec.nodeName // "") as $node
    | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
    | ([ ($m.ownerReferences // [])[] | select(.controller) ] | first) as $own
    | [ (.spec.volumes // [])[] | select(.hostPath != null) ] as $hp
    | "kind=Pod ns=\($m.namespace) name=\($m.name) uid=\($m.uid) apiVersion=v1"
      + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
      + (if $node   == ""   then "" else " node=\($node)" end)
      + (if $labels == ""   then "" else " labels=\($labels)" end)
      + (if $own    == null then "" else " owner=\($own.kind)/\($m.namespace)/\($own.name)/\($own.uid)" end)
      + (if ($hp | length) == 0 then "" else " hostPaths=\([ $hp[] | .hostPath.path ] | join("+"))" end)
      + " is_compliant=\(if ($hp | length) > 0 then "false" else "true" end)"
    ] as $rows
    | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'
)"

echo "${VERIFY_OUTPUT}"

# If any non-compliant line remains, exit non-zero
if echo "${VERIFY_OUTPUT}" | grep -q "is_compliant=false"; then
  echo "ERROR: Some pods still use hostPath volumes. Manual review required."
  echo "       Inspect the above list and adjust controller specs or naked pods accordingly."
  exit 2
fi

echo "Remediation succeeded: all checked pods are compliant (no hostPath volumes)."
exit 0

OCI Misconfigurations

Pods Should Not Mount HostPath Volumes

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation