Smelly Kube: a tool to detect security smells in Kubernetes manifests

• Ano de defesa: 2024
• Autor(a) principal: Borges, Vitor Oriel de Castro Nunes
• Outros Autores: https://orcid.org/0009-0003-8818-1263
• Orientador(a): Correia, Luiz Henrique Andrade
• Tipo de documento: Dissertação
• Tipo de acesso: Acesso aberto
• Idioma: eng
• Instituição de defesa: Universidade Federal de Lavras; Instituto de Ciências Exatas e Tecnológicas (ICET)
• Programa de Pós-Graduação: Programa de Pós-Graduação em Ciência da Computação
• Departamento: Departamento de Ciência da Computação
• País: brasil
• Palavras-chave em Português: Kubernetes; Segurança de redes de computadores; Computação em nuvem; Segurança de software; Análise estática; Computer network security; Cloud computing; Software security; Static analysis
• Área do conhecimento CNPq: Ciências Exatas e da Terra
• Link de acesso: https://repositorio.ufla.br/handle/1/60248

The adoption of microservices-based architectures has become common in modern web applications. Kubernetes stands out as a leading platform for managing and orchestrating these services due to its scalability and ability to handle complex environments. However, security risks often arise when Kubernetes manifests are not carefully designed. To address this issue, the tool Smelly Kube (SK) was developed, following a client/server architecture: i) Client: a Visual Studio Code plugin that sends Kubernetes manifests to a Golang-based server via HTTP requests, providing developers with a straightforward interface for performing security checks directly in their development environment, and ii) Server: a Golang application that processes these manifests to detect and analyze security smells. This architecture ensures that developers can easily integrate security checks into their workflows using other tools and platforms by reusing the same server API. To validate the tool’s effectiveness, an experiment was conducted, applying SK to 2,107 Kubernetes applications after sanitizing 5,055 Cloud Native packages sourced from Artifact Hub. Another dataset of 183,225 Kubernetes manifests was provided from GitHub. The results demonstrated that SK successfully detected a wide range of security smells, providing valuable insights for developers and helping to improve the overall security of Kubernetes-based microservices.