# KubeHound: Detecting Microservices' Security Smells in Kubernetes Deployments
## 4 Detecting Security Smells in Kubernetes-Based Microservices
### Hardcoded Secrets
For dynamic analysis techniques, instead, we present the detection of _Hardcoded Secrets in Containers' Environment_ and the detection of _Exposed Kubernetes Services using External-IP Field_, both of which are custom dynamic techniquesapplied to an unmodified cluster. We also present the plugin implementing the detection of _Unencrypted Pod-to-Pod Traffic_, which exploits network probes, hence being a dynamic technique applied to a modified cluster. **Listing 5**. : Example of Python script running KubeHound with an additional custom analysis (lines 14-27). The custom analysis is a static analysis called HelloWorldAnalysis (line 1), and it inputs the Kubernetes configuration files and Dockerfiles of the target application (line 6). When invoked, it prints the string \"Hello, World!\" and returns an empty list of detected smells (lines 8-12). ```
1#createnewstaticanalysisthatprintshello,World! 2 classHelloWorldAnalysis(StictaAnalysis):
3 analysis_id=\"hello_world\"
4 analysis_name=\"HelloWorldAnalysis\"
5 analysis_description=\"Thisanalysisprintshello,World!\"
6 input_types=[\"Kubernetes_config\",\"dockerfile\"]
7
8 defrun_analysis(self,input_objects:Mapping[str,List[ApplicationObject]])\
9->List[AnalysisResult]:
10#actualanalysiscodegoeshere
11 print('Hello,World!') 12 return[]
13
14#instantiatetheHoundobjectandsettheconfigurationpath
15 hound=\"Hound(Path(\"test_files/mock-application/\"))
16 hound.set_config_path(Path(\"test_files/mock-application/mock-config.yaml\"))
17
18#acquireandparsetheapplication
19 hound.aquire_application()
20 hound.parse_application()
21
22#registerHelloWorldAnalysisofthescheduler
23 hound.register_analysis(HelloWorldAnalysis)
24
25#runtheanalysesandshowtheresults
26 hound.run_analyses()
27 hound.show_results()
```
**Listing 5**. : Example of Python script running KubeHound with an additional custom analysis (lines 14-27). The custom analysis is a static analysis called HelloWorldAnalysis (line 1), and it inputs the Kubernetes configuration files and Dockerfiles of the target application (line 6). When invoked, it prints the string \"Hello, World!\" and returns an empty list of detected smells (lines 8-12). **Listing 6**. : Example of OpenAPI specification that describes a security scheme using HTTP bearer (i.e., externalAPIKey), which secures the POST method of the /foo path. ```
1 openapi:3.0.0
2 paths: //foo:{post:...,security:[externalAPIKey:[]]}components: securitySchemes:{externalAPIKey:{type:http,scheme:bearer}} }
```
**Listing 7**. : Example of OpenAPI specification that describes a security scheme using HTTP bearer (i.e., externalAPIKey), which secures the POST method of the /foo path. Multiple Authentication Endpoints in Services' API Specifications.KubeHound features a plugin implementing the method described in Section 4.9, which we implemented to enable the detection of multiple user authentication endpoints based on the services' OpennAPI specifications. The implemented plugin inputs the OpenAPI specification of the APIs of the target application's microservices, and it starts by parsing them and retrieving their security properties. If multiple endpoints are recognised as using HTTP basic authentication (i.e., username- and password-based), the plugin reports an instance of the _Multiple User Authentication_ smell. Services that have a corresponding performsAuthentication property set in the input configuration file are ignored by this plugin, since they are supposed by design to perform user authentication.