rules:
- id: hostnetwork-pod
  patterns:
  - pattern-inside: |
      spec:
        ...
  - pattern: |
      hostNetwork: true
  message: >-
    Pod may use the node network namespace. This gives the pod access to the
    loopback device, services listening on localhost, and could be used to
    snoop on network activity of other pods on the same node. Remove the
    'hostNetwork' key to disable this functionality.
  metadata:
    cwe:
    - 'CWE-406: Insufficient Control of Network Message Volume (Network Amplification)'
    references:
    - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
    category: security
    technology:
    - kubernetes
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages: [yaml]
  severity: WARNING