Lesson 0017 · 45 minutes · Minimize Microservice Vulnerabilities

Block host-escape settings before scheduling

Namespace isolation is weak if a tenant can request host namespaces, host networking, privileged containers, or hostPath volumes. This drill uses native CEL admission controls to make those settings unrepresentable in one tenant namespace.

Exam reflex: protect optional fields with CEL has(...) checks. A policy must handle an omitted securityContext as safely as an explicit false.

Timed task: 35 minutes

Apply lab/lesson-17-fixture.yaml. Create lab/lesson-17-answer.yaml from scratch containing a ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding.

Only in namespace tenant-a, deny Pod creates and updates when any of the following is true:

hostNetwork, hostPID, or hostIPC is true.
Any volume is a hostPath volume.
Any regular container is privileged.

The policy must allow a normal unprivileged Pod that omits all of these fields. Use failurePolicy: Fail, a useful denial message, and Deny in the binding. Scope the binding with the supplied namespace label; do not apply it cluster-wide or use a webhook.

Verification

kubectl --context kind-cks-lab apply -f .\lab\lesson-17-fixture.yaml
kubectl --context kind-cks-lab apply -f .\lab\lesson-17-answer.yaml
kubectl --context kind-cks-lab -n tenant-a run normal --image=busybox:1.37 --restart=Never -- sh -c 'sleep 60'
kubectl --context kind-cks-lab -n tenant-a run host-net --image=busybox:1.37 --restart=Never --overrides '{"apiVersion":"v1","spec":{"hostNetwork":true}}' -- sh -c 'sleep 60'
kubectl --context kind-cks-lab -n default run host-net-outside --image=busybox:1.37 --restart=Never --overrides '{"apiVersion":"v1","spec":{"hostNetwork":true}}' -- sh -c 'sleep 60'

Expected: normal is admitted, host-net is rejected, and host-net-outside is admitted. Clean up the two admitted test Pods afterward. Also inspect your CEL carefully: the commands prove host networking, while the policy must cover all four listed controls.

Retrieval check

Question

Why is a plain expression such as c.securityContext.privileged == false unsafe for this task?

A container can omit securityContext; the expression must handle optional fields without an evaluation error.Privileged is a namespace-level field.Privileged containers always require a host port.

Documentation target

Use the Kubernetes Validating Admission Policy reference and inspect CEL field availability with kubectl explain pod.spec.

What to send me

Paste the policy and binding, plus the three admission outcomes. I’ll inspect scope, optional-field handling, and every escape path.