Pod does not use HostPorts
Kubernetes Pods are inspected for any container declaring ports[].hostPort. The finding highlights workloads that bind container ports directly to the node's network stack via HostPorts.
ProwlerRisk
Using HostPorts exposes Pods on node IPs outside centralized Service/Ingress controls. Attackers can directly probe and access workloads (confidentiality/integrity). Port conflicts or saturation on nodes can disrupt traffic (availability). Network segmentation and some policies may be less effective.
Run this check with Prowler
Run in Prowler Cloudprowler kubernetes --checks core_minimize_admission_hostport_containersRecommendation
Avoid hostPort; publish services via ClusterIP with Ingress/LoadBalancer. Enforce admission policies to deny hostPort by default, permitting only a narrowly justified allowlist. Apply least privilege network rules, segment nodes, and monitor for unexpected host port bindings as defense in depth.
Remediation
Terraform
resource "kubernetes_pod" "<example_resource_name>" {
metadata { name = "<example_resource_name>" }
spec {
container {
name = "<example_resource_name>"
image = "nginx"
# Critical: do NOT set host_port; omitting it ensures no host port is used
port { container_port = 80 }
}
}
}Other
Check Code
from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client
class core_minimize_admission_hostport_containers(Check):
def execute(self) -> Check_Report_Kubernetes:
findings = []
for pod in core_client.pods.values():
report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
report.status = "PASS"
report.status_extended = f"Pod {pod.name} does not use HostPorts."
for container in pod.containers.values():
if container.ports and "host_port" in str(container.ports):
report.status = "FAIL"
report.status_extended = (
f"Pod {pod.name} uses HostPorts in container {container.name}."
)
break
findings.append(report)
return findings