All host namespaces should be disabled unless they are explicitly needed.

• HostPID: Governs whether the pod containers can share the host process ID namespace. It's important to note that when combined with ptrace, this can be exploited to escalate privileges outside of the container. (ptrace is forbidden by default).
• HostIPC: Governs whether the pod containers can share the host IPC namespace.
• HostNetwork: Governs whether the pod may use the node network namespace. Enabling this provides the pod access to the loopback device, services listening on localhost, and could potentially be exploited to monitor network activity of other pods on the same node.

Remediation

Set hostPID, hostIPC, and hostNetwork to false