Smelly Kube: a tool to detect security smells in Kubernetes manifests

Abstract

The adoption of microservices-based architectures has become common in modern web applications. Kubernetes stands out as a leading platform for managing and orchestrating these services due to its scalability and ability to handle complex environments. However, security risks often arise when Kubernetes manifests are not carefully designed. To address this issue, the tool Smelly Kube (SK) was developed, following a client/server architecture: i) Client: a Visual Studio Code plugin that sends Kubernetes manifests to a Golang-based server via HTTP requests, providing developers with a straightforward interface for performing security checks directly in their development environment, and ii) Server: a Golang application that processes these manifests to detect and analyze security smells. This architecture ensures that developers can easily integrate security checks into their workflows using other tools and platforms by reusing the same server API. To validate the tool’s effectiveness, an experiment was conducted, applying SK to 2,107 Kubernetes applications after sanitizing 5,055 Cloud Native packages sourced from Artifact Hub. Another dataset of 183,225 Kubernetes manifests was provided from GitHub. The results demonstrated that SK successfully detected a wide range of security smells, providing valuable insights for developers and helping to improve the overall security of Kubernetes-based microservices.