AKS host network of POD

Question

What is impact of changing host network of a pod from TRUE to FALSE?
And what are the test cases of this feature?

Answer 1

hello @sns

you can change the value of the hostNetwork from helm chart Values.yaml file once you pull it from this link

1- helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
2- helm pull gatekeeper/gatekeeper
3- tar -zxvf gatekeeper-3.11.0.tgz

you can change the value of the hostNetwork to false from the values.yaml as below :

or you can add --set flag using helm command :

helm install -n gatekeeper-system [RELEASE_NAME] gatekeeper/gatekeeper --set controllerManager.hostNetwork=false

you can check the helm chart that you are using and follow the same steps.

I advise you to use the gatekeeper extension with aks as its supported check this document as below:

also to use the fluxV2 check this document

Answer 2

hello @sns

I hope you are doing fine.

hostNetwork is a setting at the pod level, I would not set it unless you know you need it.

https://www.alibabacloud.com/help/en/container-service-for-kubernetes/latest/use-the-host-network this is an example of how it gets set.

You can imagine for example, many CNI use kubernetes daemonset to install themselves. But if they do not set hostNetwork: true, deploying the daemonset will require CNI to allocation IPs per pod. But CNI isn't installed, because that's what the DS is supposed to do...hostNetwork: true is one way out of that.

It presents other issues though, as once you start manually assigning IP:PORT to pods, you tend to have higher chances of conflicts, need to be careful about remapping ports manually, etc. -- things the normal k8s networking model is supposed to solve.

once you start to change the host network from true to false, it will assign normal IP from the pods CIDR range.

example:

deployment it use hostnetwork is set to true as below:

the POD created it took the same IP of the node:

once you remove the Hostnetwork flag it will take IP from the same pod IP range.

once you exec pod and test it will work with you with the new POD IP or the service name/IP

I suggest testing it on a test cluster.

I hope this can help you

Looking forward to your feedback,

Best Regards,

Answer 3

Hi @sns ,

If HostNetwork set to true; pod will use the node networking namespace and network resources of the node instead of the regular isolation, the networking aspect of the containers will be the same as if the process is working on the node directly, so the pod can access any service running on the localhost of the node, listen to addresses and monitor the traffic of other pods on the same node.

Use cases:

1. kube-proxy which configures iptables in the node networking namespace.
2. Applications that need to pcap on node.

I would not set HostNetowrk to true (Default is False) unless you know you need it.

Hope this helps.

Please "Accept as Answer" if it helped, so that it can help others in the community looking for help on similar topics.

Answer 4

hello @sns

can you try to add flag --install as below :

helm upgrade --install -n gatekeeper-system 3.7.0 gatekeeper/gatekeeper --set controllerManager.hostNetwork=true

If the ANSWER is helpful, please click "Accept Answer" and upvote it.

Thank you!