Allowing K8S daemonset to exist in the global pid namespace

Question

I'm trying to configure a daemonset to run on the global pid namespace resulting the ability to see other processes in the host, including the containers' processes.

I couldn't find an option to achieve this. In general, what I'm looking for is close to the sidecar container shareProcessNamespace attribute only on the host level.

Answer 1

There is an attribute that allows this - hostPID: true

So the yaml file should looks something like that:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: busybox
spec:
  selector:
    matchLabels:
      name: busybox
  template:
    metadata:
      labels:
        name: busybox
    spec:
      hostPID: true
      containers:
      - name: busybox
        image: busybox
        command: [ "sh", "-c", "sleep 1h" ]

More info in:

• https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
• https://medium.com/@chrispisano/limiting-pod-privileges-hostpid-57ce07b05896