iac/kubernetes/k8s-host-namespace

Pod shares a host namespace

highKubernetesiac-kubernetes

What it detects

`hostNetwork`, `hostPID`, or `hostIPC` set to true breaks the namespace boundary between the pod and the node — the container can see host network interfaces, processes, or IPC, widening the blast radius of any compromise.

Remediation

Remove the host namespace flag. Workloads almost never need direct host network/PID/IPC access.

How it runs

Run against YAML files that look like Kubernetes manifests (top-level `apiVersion:` + `kind:`). Line-based checks across multi-document files; Helm-templated lines are skipped.

Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.