# KubeHound: Detecting Microservices' Security Smells in Kubernetes Deployments
## 4 Detecting Security Smells in Kubernetes-Based Microservices
### Hardcoded Secrets
The configuration files used in the above-described experiment are publicly available online ([[https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples/openapi_security/openapi_mua](https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples/openapi_security/openapi_mua)]([https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples/openapi_security/openapi_mua](https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples/openapi_security/openapi_mua)), accessed on 26 June 2023). #### 6.1.3 Unnecessary Privileges to Kubernetes Pods

To experiment with the plugin detecting _Unnecessary Privileges to Kubernetes Pods_, we generated three alternative versions of the Kubernetes deployment of echo1, each giving some services unnecessary privileges in a different way. * In echo1_no_resources.yaml, there are no resource limits and requests specified, which could starve the cluster. * In echo1_no_securitycontext.yaml, the security context of the pod is not specified. * In echo1_privileged.yaml, the pod is set to be deployed in privileged mode. Figure 4: Microservice architecture of the mock application. All the above-listed files can be found in KubeHound's GitHub repository ([[https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples/kubesec](https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples/kubesec)]([https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples/kubesec](https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples/kubesec)), accessed on 26 June 2023). We then ran KubeHound on the mock application deployment, each time considering a different alternative of the Kubernetes deployment of echo1 among those listed above. As a result, we observed that KubeHound effectively identified all the injected smell instances. #### 6.1.4 Hardcoded Secrets in Containers' Environment

In this case, we added a service to our smell-free mock application deployment called secrets-holder. The latter is a dummy service that does not interact with the rest of the application, but just contains _Hardcoded Secrets_ in its environment variables (viz., a database password, an AWS key, high-entropy hex and base64 strings, and a URL that contains basic authorisation credentials). The Kubernetes manifest file to add secrets-holder to the mock application deployment is publicly available online ([[https://github.com/di-unipi-socc/kube-hound/blob/master/data/examples/secrets_in_env/secrets-holder.yaml](https://github.com/di-unipi-socc/kube-hound/blob/master/data/examples/secrets_in_env/secrets-holder.yaml)]([https://github.com/di-unipi-socc/kube-hound/blob/master/data/examples/secrets_in_env/secrets-holder.yaml](https://github.com/di-unipi-socc/kube-hound/blob/master/data/examples/secrets_in_env/secrets-holder.yaml)), accessed on 26 June 2023). We hence deployed secrets-holder in a Kubernetes cluster alongside our smell-free application deployment, and we ran KubeHound to analyse the services deployed on the cluster. As a result, we observed that KubeHound effectively identified all the instances of the _Hardcoded Secrets_ smell that we injected into the secrets-holder. #### 6.1.5 Exposed Kubernetes Services Using External-IP Field

For this experiment, we updated the Kubernetes deployment of the echo1 service, changing its type to a LoadBalancer. In this way, we prescribed it to be exposed outside of the cluster where it is deployed, hence injecting a _Publicly Accessible Microservices_ smell. The updated Kubernetes deployment is publicly available on GitHub ([[https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples/external_ip](https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples/external_ip)]([https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples/external_ip](https://github.com/di-unipi-socc/kube-hound/tree/master/data/examples/external_ip)), accessed on 26 June 2023). We deployed the updated mock application on a Kubernetes cluster.