Back to Checks
kubernetes

Pod does not use hostPath volumes

core_minimize_hostpath_volume_mounts
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:container-securitytrust-boundaries
Resource Type:Pod

Kubernetes Pods are evaluated for volumes of type hostPath, which mount paths from the node filesystem into a pod.

Prowler logoProwlerprowler-provider-kubernetes

Risk

hostPath volumes weaken the container boundary by exposing node files to workloads. A compromised container can read sensitive host data, tamper with node files, or use writable mounts to escalate privileges and affect node availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_minimize_hostpath_volume_mounts

Recommendation

Disallow hostPath volumes by default with Pod Security Admission or policy-as-code controls. Permit narrow, read-only exceptions only for trusted system workloads, and prefer Kubernetes-native volume types that do not expose the node filesystem.

Remediation

CLI

kubectl get pod <pod_name> -n <namespace> -o jsonpath='{range .metadata.ownerReferences[*]}{.kind}/{.name}{"\n"}{end}{range .spec.volumes[?(@.hostPath)]}{.name}{"\t"}{.hostPath.path}{"\n"}{end}'
# If the Pod is managed by a controller, edit the owning workload and remove hostPath volumes from its Pod template:
kubectl edit <workload_kind>/<workload_name> -n <namespace>
# For a standalone Pod, export the manifest, remove hostPath volumes, then recreate it:
kubectl get pod <pod_name> -n <namespace> -o yaml > pod.yaml
kubectl delete pod <pod_name> -n <namespace>
kubectl apply -f pod.yaml

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    container {
      name  = "app"
      image = "nginx"
    }
    # Do not define host_path blocks under volume.
  }
}

Other

1Identify the workload that owns the failing Pod (Deployment/DaemonSet/StatefulSet/Job) or confirm it is a standalone Pod
2Edit the Pod template and remove volumes that define `hostPath`
3Replace hostPath with a safer volume type such as ConfigMap, Secret, emptyDir, persistentVolumeClaim, or a CSI volume when appropriate
4Apply the updated manifest and allow the workload to recreate Pods without hostPath volumes

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_minimize_hostpath_volume_mounts(Check):
    def execute(self) -> list[Check_Report_Kubernetes]:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Pod {pod.name} does not use hostPath volumes."

            for volume in pod.volumes or []:
                if volume.get("host_path"):
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Pod {pod.name} uses hostPath volume {volume['name']}."
                    )
                    break

            findings.append(report)

        return findings

References