# KubeHound: Detecting Microservices' Security Smells in Kubernetes Deployments
## 4 Detecting Security Smells in Kubernetes-Based Microservices
### Hardcoded Secrets
A snapshot of the current version of the tool is also stored on Software Heritage at [[https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/di-unipi-socc/kube-hound](https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/di-unipi-socc/kube-hound)]([https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/di-unipi-socc/kube-hound](https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/di-unipi-socc/kube-hound)), accessed on 26 June 2023). It is implemented in Python, and this is mainly motivated by the fact that Python already features a rich ecosystem of libraries, including those to process/interact with Docker and Kubernetes (2018). **Input Configuration File**. KubeHound takes as input a YAML configuration file structured in four main YAML objects, viz., repositories, deployment, services, and properties, as shown in Listing 4. * The object repositories provides a list of named repositories storing the deployment configuration files and source code of the target microservice application. The listed repositories can be local folders or remote git repositories, which will be cloned locally by KubeHound when starting to analyse the target application. The need to organise the application source in multiple logical repositories comes from the fact that many microservice applications are developed in a \"one repository per microservice\" fashion, so tracking the different sources for different microservices' files requires an additional layer of abstraction. * The object deployment indicates the repository where the configuration files specifying the target application deployment is found by also supporting regular expressions to match all deployment configuration files. Currently, only kubernetes configuration files are supported, but the syntax is intended to allow for extending the support to other deployment frameworks. * The object services lists all the microservices forming the target application by associating them with the paths to their related configuration files, source code, and the specification of their APIs in OpenAPI, if available. * The object properties provides a list of claimed properties for the services, which can be used by KubeHound to ignore some detected smells to reduce the amount of false positive reports. Currently, two properties are supported, viz., external, to indicate that a service is intentionally exposed to external clients, and performsAuthentication, to indicate that a service is known to perform authentication. KubeHound will ignore any missing field in the configuration file, and it will apply a \"best effort\" approach to provide meaningful results out of the provided resources. **Application Acquisition and Parsing**. The repositories described in the configuration files are first acquired and parsed by KubeHound. For local folders, the acquisition phase is not present, while remote git repositories are cloned locally in the current working directory. If a folder with the same name already exists, KubeHound will try to detect if it is a git repository and will perform a pull command to fetch the latest version of the repository. This provides a mechanism to avoid always downloading the full application on each run of the tool, which can be costly for large code bases. Once all the files are gathered, KubeHound will perform the parsing of the application, which means taking the application files and turning them into a collection of application objects. An application object is an object that represents any resource in the application. They have three main fields: type, path, and data. type specifies the type of object (viz., kubernetes_config, dockerfile, or openapi), path specifies the path of the corresponding application file, while data specifies optional metadata of the object.