# KubeHound: Detecting Microservices' Security Smells in Kubernetes Deployments
## 4 Detecting Security Smells in Kubernetes-Based Microservices
### Hardcoded Secrets
Unnecessary Privileges to Kubernetes Pods with Kubesecio.We implemented the method described in Section 4.3 as a plugin of KubeHound to enable the detection of unnecessary privileges to Kubernetes pods ([[https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/unnecessary_privileges_pods.py](https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/unnecessary_privileges_pods.py)]([https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/unnecessary_privileges_pods.py](https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/unnecessary_privileges_pods.py)), accessed on 26 June 2023). To accomplish this, the implemented plugin integrates with the tool Kubesec.io [14] to perform such an analysis. Kubesec.io indeed employs a suite of test cases to check for minimum privileges in Kubernetes pod configuration files, and it comes as a Docker image on DockerHub, which we can directly pull and execute. Docker will take care of fetching (if not already present on the local machine) the Kubesec.io image, hence favouring the distribution and packaging of KubeHound. To interact with the Docker daemon, the plugin uses the Docker Python library, which exposes an API to interact with Docker containers [36]. This plugin thus starts Kubesec.io in a Docker container, which starts a web server that exposes a REST API. The plugin submits the application's Kubernetes configuration files using the /scan endpoint, and the Kubesec.io server then returns a JSON response containing a list of passed and failed checks. Such results are parsed and each failing test case reported by Kubesec.io is considered as an instance of the _Umnecessary Privileges to Microservices_ smell. Hardcoded Secrets in Containers' Environment.We implemented the detection of _Hardcoded Secrets in Containers' Environment_ described in Section 4.6 by developing a plugin for KubeHound that exploits the Kubernetes Python client library to interact with the Kubernetes API of a cluster ([[https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/hardcoded_secrets_environment.py](https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/hardcoded_secrets_environment.py)]([https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/hardcoded_secrets_environment.py](https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/hardcoded_secrets_environment.py)), accessed on 26 June 2023). The plugin retrieves all the running pods of the clusters, and for each pod it retrieves all the running containers. It then executes the env command on each container and stores the resulting output, which is then processed to detect secrets. For detecting secrets, the plugin uses the open-source Python module detect-secrets [37], which provides a built-in set of secret-detection techniques. If any environment variable is detected as storing a secret, the plugin reports the _Hardcoded Secrets_ smell, together with a description of the variable that stores the secret. In the output of KubeHound the actual values are obfuscated to prevent accidental secret exposure. Exposed Kubernetes Services using External-IP Field.We implemented the detection of _Exposed Kubernetes Services using External-IP Field_ as a plugin for KubeHound that dynamically looks for exposed services by retrieving the External-IP field as described in Section 4.2 ([[https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/exposed_services_external_ip.py](https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/exposed_services_external_ip.py)]([https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/exposed_services_external_ip.py](https://github.com/di-unipi-socc/kube-hound/blob/master/kube_hound/builtin_analyses/exposed_services_external_ip.py)), accessed on 26 June 2023).