Kubetier
T1hostNetwork networkPolicy bypass

  1. Create a pod with spec.hostNetwork set to true.

  2. The pod shares the node's network namespace and uses the node's address, so it is no longer on the pod network.

  3. NetworkPolicy selects pods by their pod-network identity, so an ordinary namespace policy does not constrain it.

    Some CNIs provide a separate host-level firewall that can.

  4. Node-local services become reachable, including the kubelet on 10250 and anything bound to the node's loopback or link-local addresses.

  5. The dependable control is Pod Security Admission at baseline or restricted, which rejects spec.hostNetwork at admission.

Note:

Namespace NetworkPolicy does not select host-network pods.

Whether host traffic can be policed at all is a property of the CNI, not of Kubernetes.

The effective control is Pod Security Admission at baseline or restricted, which rejects spec.hostNetwork.

K8s docs ↗