OCI OKE Should Minimize Containers Sharing the Host IPC Namespace

1. Find workloads using hostIPC: true.
2. Update their Pod/Deployment specs to remove it.
3. Optionally enforce a policy so it doesn’t reappear.

​

1. Open your OKE cluster from the OCI Console

1. Sign in to the OCI Console.
2. In the left-hand menu, go to:
   Developer Services → Containers & Artifacts → Kubernetes Clusters (OKE).
3. Select the Compartment where your cluster lives.
4. Click your OKE cluster name to open its details page.

​

2. Connect to the cluster using Cloud Shell from the Console

1. On the cluster details page, find the “Access Cluster” or “Cluster Access” section.
2. Click “Cloud Shell” (or the Cloud Shell icon in the top-right of the console).
   • This opens a terminal at the bottom of the console.
3. In the cluster page, click “Copy kubeconfig” or follow the “Access Cluster” instructions:
   • Usually:
     oci ce cluster create-kubeconfig \
       --cluster-id <cluster-ocid> \
       --file $HOME/.kube/config \
       --region <your-region> \
       --token-version 2.0.0 \
       --kube-endpoint PUBLIC_ENDPOINT
     
   • Then verify:
     kubectl get nodes
     
   • If nodes are shown, you are connected.

​

3. Identify Pods/Workloads using hostIPC: true

1. List all pods (all namespaces) including their full spec:
   kubectl get pods -A -o yaml | grep -n "hostIPC"
   
2. Or search at deployment level:
   kubectl get deploy,statefulset,daemonset -A -o yaml | grep -n "hostIPC"
   

spec:
  hostIPC: true

​

4. Edit each workload and remove hostIPC: true

1. Edit a Deployment (example):
   kubectl -n <namespace> edit deploy <deployment-name>
   
2. In the editor that opens, look for:
   spec:
     template:
       spec:
         hostIPC: true
   
3. Remove the line hostIPC: true entirely (or change to false):
   spec:
     template:
       spec:
         # hostIPC: true   <-- remove this line
   
4. Save and exit (in vi: press Esc, then :wq and Enter).
5. Kubernetes will roll out a new ReplicaSet without hostIPC.

kubectl -n <namespace> edit statefulset <name>
kubectl -n <namespace> edit daemonset <name>

kubectl -n <namespace> edit pod <pod-name>

​

5. Confirm hostIPC is no longer used

kubectl get pods -A -o yaml | grep -n "hostIPC"

​

6. (Optional) Add a policy to prevent hostIPC in the future

​

6.1 Enable Pod Security Admission (recommended on new/newer clusters)

1. Choose a Pod Security Standard level, e.g., restricted (which disallows host namespaces like hostIPC).
2. From Cloud Shell, label your namespaces, for example:
   # Example: enforce restricted pod security in a namespace
   kubectl label namespace <namespace> \
     pod-security.kubernetes.io/enforce=restricted \
     --overwrite
   

​

6.2 Or use OPA Gatekeeper / Kyverno (if you already have it)

​

7. If the misconfiguration came from Helm or CI/CD

1. Update the Helm chart values or YAML manifests in your repo:
   • Remove or set hostIPC: false in the template:
     spec:
       hostIPC: false
     
2. Re‑deploy from your pipeline/Helm to ensure it doesn’t reintroduce the setting.

1. Make sure you can talk to the cluster via CLI
   # 1. Get cluster OCID
   oci ce cluster list --compartment-id <compartment_ocid>
   
   # 2. Generate kubeconfig for this cluster
   oci ce cluster create-kubeconfig \
     --cluster-id <cluster_ocid> \
     --file $HOME/.kube/oke-config \
     --region <region> \
     --token-version 2.0.0 \
     --kube-endpoint PUBLIC_ENDPOINT
   
   export KUBECONFIG=$HOME/.kube/oke-config
   
   # 3. Verify kubectl works
   kubectl get nodes
   
2. Find workloads using hostIPC: true This flag can be set at pod or pod-template level.
   # Check all namespaces
   kubectl get pods -A -o yaml | grep -n "hostIPC: true" -B3 -A5
   
   # Check Deployments
   kubectl get deploy -A -o yaml | grep -n "hostIPC: true" -B5 -A10
   
   # Check StatefulSets
   kubectl get statefulset -A -o yaml | grep -n "hostIPC: true" -B5 -A10
   
   # Check DaemonSets
   kubectl get daemonset -A -o yaml | grep -n "hostIPC: true" -B5 -A10
   
3. Edit the manifests to disable host IPC For each object you found (Deployment, StatefulSet, DaemonSet, Pod):
   # Example: edit a deployment in place
   kubectl -n <namespace> edit deployment <name>
   
   In the resulting YAML, locate the pod spec and remove or set:
   spec:
     template:
       spec:
         hostIPC: false   # or remove the line entirely
   
   Save and exit. Kubernetes will roll out new pods without host IPC. Repeat for any StatefulSets, DaemonSets, or standalone Pods:
   kubectl -n <namespace> edit statefulset <name>
   kubectl -n <namespace> edit daemonset <name>
   kubectl -n <namespace> edit pod <name>   # for static/one-off pods
   
4. Verify that host IPC is no longer used
   # Re-check for hostIPC: true
   kubectl get pods -A -o yaml | grep -n "hostIPC: true" -B3 -A5 || echo "No pods using hostIPC"
   
   # Optionally check pod descriptions
   kubectl -n <namespace> describe pod <pod_name> | grep -i hostIPC || echo "Not set"
   
5. (Recommended) Enforce policy so hostIPC cannot be re-enabled Use Kubernetes Pod Security Admission (if 1.25+) or Gatekeeper. Option A – Pod Security Admission (namespace labels) For “restricted” policy level (blocks host IPC):
   # Label namespaces to enforce restricted pod security
   kubectl label namespace <ns> \
     pod-security.kubernetes.io/enforce=restricted \
     pod-security.kubernetes.io/enforce-version=latest \
     --overwrite
   
   This will reject new pods with hostIPC: true in those namespaces. Option B – Gatekeeper constraint (if you have Gatekeeper installed) Example K8sPSPHostIPC constraint:
   apiVersion: constraints.gatekeeper.sh/v1beta1
   kind: K8sPSPHostIPC
   metadata:
     name: disallow-hostipc
   spec:
     match:
       kinds:
         - apiGroups: [""]
           kinds: ["Pod"]
       namespaces:
         - "<your-namespace>"   # or omit to apply cluster-wide
   
   Apply:
   kubectl apply -f disallow-hostipc.yaml
   

1. Use oci ce cluster create-kubeconfig to set kubeconfig.
2. Use kubectl to:
   • discover pods with hostIPC: true,
   • edit workloads to remove hostIPC,
   • optionally enforce namespace-level Pod Security labels or Gatekeeper constraints.

1. Detect all workloads using hostIPC: true.
2. Patch them to remove or disable hostIPC.
3. Optionally enforce a policy so it can’t be reintroduced.

​

1. Prerequisites

pip install kubernetes

kubectl config use-context <your-oke-context>

​

2. Python: Find all workloads with hostIPC: true

from kubernetes import client, config

def has_hostipc(pod_spec):
    return getattr(pod_spec, "host_ipc", False) is True

def main():
    # Load kubeconfig
    config.load_kube_config()  # or config.load_incluster_config() if running inside a pod

    apps_v1 = client.AppsV1Api()
    core_v1 = client.CoreV1Api()

    # Namespaces to scan (None => all)
    namespaces = [ns.metadata.name for ns in core_v1.list_namespace().items]

    for ns in namespaces:
        print(f"\nNamespace: {ns}")

        # Deployments
        for d in apps_v1.list_namespaced_deployment(ns).items:
            if has_hostipc(d.spec.template.spec):
                print(f"Deployment with hostIPC: {d.metadata.name}")

        # StatefulSets
        for ss in apps_v1.list_namespaced_stateful_set(ns).items:
            if has_hostipc(ss.spec.template.spec):
                print(f"StatefulSet with hostIPC: {ss.metadata.name}")

        # DaemonSets
        for ds in apps_v1.list_namespaced_daemon_set(ns).items:
            if has_hostipc(ds.spec.template.spec):
                print(f"DaemonSet with hostIPC: {ds.metadata.name}")

        # ReplicaSets (if needed)
        for rs in apps_v1.list_namespaced_replica_set(ns).items:
            if has_hostipc(rs.spec.template.spec):
                print(f"ReplicaSet with hostIPC: {rs.metadata.name}")

        # Standalone Pods
        for p in core_v1.list_namespaced_pod(ns).items:
            if has_hostipc(p.spec):
                print(f"Pod with hostIPC: {p.metadata.name}")

if __name__ == "__main__":
    main()

​

3. Python: Patch workloads to disable hostIPC

from kubernetes import client, config

def patch_hostipc_false():
    config.load_kube_config()
    apps_v1 = client.AppsV1Api()
    core_v1 = client.CoreV1Api()

    namespaces = [ns.metadata.name for ns in core_v1.list_namespace().items]

    def patch_deployment(ns, name):
        body = {"spec": {"template": {"spec": {"hostIPC": False}}}}
        apps_v1.patch_namespaced_deployment(name=name, namespace=ns, body=body)
        print(f"Patched Deployment {ns}/{name}")

    def patch_statefulset(ns, name):
        body = {"spec": {"template": {"spec": {"hostIPC": False}}}}
        apps_v1.patch_namespaced_stateful_set(name=name, namespace=ns, body=body)
        print(f"Patched StatefulSet {ns}/{name}")

    def patch_daemonset(ns, name):
        body = {"spec": {"template": {"spec": {"hostIPC": False}}}}
        apps_v1.patch_namespaced_daemon_set(name=name, namespace=ns, body=body)
        print(f"Patched DaemonSet {ns}/{name}")

    def patch_pod(ns, name):
        body = {"spec": {"hostIPC": False}}
        core_v1.patch_namespaced_pod(name=name, namespace=ns, body=body)
        print(f"Patched Pod {ns}/{name}")

    def has_hostipc(pod_spec):
        return getattr(pod_spec, "host_ipc", False) is True

    for ns in namespaces:
        # Deployments
        for d in apps_v1.list_namespaced_deployment(ns).items:
            if has_hostipc(d.spec.template.spec):
                patch_deployment(ns, d.metadata.name)

        # StatefulSets
        for ss in apps_v1.list_namespaced_stateful_set(ns).items:
            if has_hostipc(ss.spec.template.spec):
                patch_statefulset(ns, ss.metadata.name)

        # DaemonSets
        for ds in apps_v1.list_namespaced_daemon_set(ns).items:
            if has_hostipc(ds.spec.template.spec):
                patch_daemonset(ns, ds.metadata.name)

        # Standalone Pods (note: they may be recreated by a controller)
        for p in core_v1.list_namespaced_pod(ns).items:
            # Skip pods managed by controllers; fix the controller instead
            if p.metadata.owner_references:
                continue
            if has_hostipc(p.spec):
                patch_pod(ns, p.metadata.name)

if __name__ == "__main__":
    patch_hostipc_false()

kubectl get deploy,statefulset,daemonset,pod -A -o yaml | grep -n hostIPC

​

4. Optional: Enforce policy (prevent future hostIPC)

• OPA Gatekeeper or Kyverno to deny workloads with hostIPC: true, e.g. a Gatekeeper ConstraintTemplate that rejects .spec.template.spec.hostIPC == true.