SMELLY KUBE: AN APPLICATION PROGRAMMING INTERFACE (API) TO DETECT SECURITY SMELLS IN KUBERNETES MANIFESTS
Security, Security smells, Misconfiguration, Kubernetes, Kubernetes manifests
The adoption of microservices-based architectures has become increasingly common, with Kubernetes standing out as a leading platform for managing and orchestrating these services due to its scalability and ability to handle complex environments. However, security risks often arise when Kubernetes manifests are not carefully designed. To address this issue, the tool Smelly Kube (SK) was developed, following a client/server architecture: i) Client: a Visual Studio Code plugin that sends Kubernetes manifests to a Golang-based server via HTTP requests, providing developers with a straightforward interface for performing security checks directly in their development environment, and ii) Server: a Golang application that processes these manifests to detect and analyze security smells. This architecture ensures that developers can easily integrate security checks into their workflows. To validate the tool's effectiveness, an experiment was conducted, applying SK to 2,107 Kubernetes applications after sanitizing 5,055 Cloud Native packages sourced from Artifact Hub. Another dataset of 183,225 Kubernetes manifests was provided from GitHub. The results demonstrated that SK successfully detected a wide range of security smells, providing valuable insights for developers and helping to improve the overall security of Kubernetes-based microservices.