# KubeHound: Detecting Microservices' Security Smells in Kubernetes Deployments
## 4 Detecting Security Smells in Kubernetes-Based Microservices
### Hardcoded Secrets
```
repositories: main: (git: [[https://github.com/microservices-demo/microservices-demo.git](https://github.com/microservices-demo/microservices-demo.git)]([https://github.com/microservices-demo/microservices-demo.git](https://github.com/microservices-demo/microservices-demo.git)) ) front-end: {git: [[https://github.com/microservices-demo/front-end.git](https://github.com/microservices-demo/front-end.git)]([https://github.com/microservices-demo/front-end.git](https://github.com/microservices-demo/front-end.git)) } shipping: {git: [[https://github.com/microservices-demo/shipping.git](https://github.com/microservices-demo/shipping.git)]([https://github.com/microservices-demo/shipping.git](https://github.com/microservices-demo/shipping.git)) }... deployment: kubernetes: { repository: main, glob: deploy/kubernetes/manifets/s.yaml } services: - { name: front-end, image: weaveworksdemos/front-end:0.3.12, repository: front-end, - {name: shipping, image: weaveworkdemos/shipping:0.4.8, repository: shipping, dockerfile: docker/shipping/Dockerfile }...  
properties: front-end: { external: true }
```
For Dockerfiles and OpenAPI specifications, application objects map one-to-one to a particular file. For Kubernetes configuration files, instead, multiple application objects can be generated from the same file, one for each YAML document. KubeHound will also put in the data object the claimed properties specified in the configuration file. KubeHound will also follow a \"best effort\" approach for application parsing, so if there are missing resources or no metadata available for a given object, it will simply be ignored. **Analysis Scheduling and Results**. The Scheduler component prepares the inputs for all the available analyses, runs them, and collects their results. For this to happen, analysis techniques must be implemented as Python classes extending the existing StaticAnalysis or DynamicAnalysis classes, as exemplified in Listing 5. The analyses expose some parameters through class variables, such as their name or their description, and implement their functionality through the run_analysis method. They also expose the input_types variable, which specifies the types of input this analysis requires. Any particular analysis is called only if there is at least one available object of the required types, passing them as a list of application objects to the run_analysis method. Custom analyses can be added to the scheduler using the register_analysis method (as shown in Listing 5). Each analysis is expected to complete in a finite time, and this is particularly important for dynamic analyses needing to run for longer periods, e.g., to first monitor and then analyse the traffic exchanged among deployed microservices (as described in Section 4.7). Upon completion, the analysis returns a list of results, represented as Python objects. The results returned by all the run analysis plugins are collected together by the Scheduler, and they are suitably merged to compute the union of all detected smell instances. KubeHound then returns the merged results as the output of the overall analysis by streamlining them to a JSON representation. ### Implementation of Selected Analyses

We hereby illustrate the implementation of six of the analysis techniques described in Section 4, which come as built-in plugins in KubeHound. The selection of which analysis plugins to present was mainly aimed at showcasing the different types of techniques, while also demonstrating the possibility of implementing them by integrating them with existing analysis tools. For static analysis techniques, we present the plugins implementing the detection of _Insufficient Access Control in API Specifications_ and _Multiple Authentication Endpoints in Services' API Specifications_, both analyzing the OpenAPI specifications. We also present the detection of _Unnecessary Privileges to Kubernetes Pods_, which we realised by integrating the tool Kubesec.io [14].