Check ID: core_minimize_admission_hostport_containers
Provider: Kubernetes
Service: core
Severity: HIGH
Categories: internet-exposed, trust-boundaries
Resource type: Pod

​
What this check verifies

Kubernetes Pods are inspected for any container declaring ports[].hostPort. The finding highlights workloads that bind container ports directly to the node’s network stack via HostPorts.

​
Risk

Using HostPorts exposes Pods on node IPs outside centralized Service/Ingress controls. Attackers can directly probe and access workloads (confidentiality/integrity). Port conflicts or saturation on nodes can disrupt traffic (availability). Network segmentation and some policies may be less effective.

​
Recommendation

Avoid hostPort; publish services via ClusterIP with Ingress/LoadBalancer. Enforce admission policies to deny hostPort by default, permitting only a narrowly justified allowlist. Apply least privilege network rules, segment nodes, and monitor for unexpected host port bindings as defense in depth.

​
Remediation

resource "kubernetes_pod" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "nginx"
      # Critical: do NOT set host_port; omitting it ensures no host port is used
      port { container_port = 80 }
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = core_minimize_admission_hostport_containers. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks