Security Misconfiguration: Absent Security Context and Use of HTTP Without TLS

[akondasif]

Dear Colleague,

We are looking to find ways to help developers find security misconfigurations, i.e., violation of security best practices in Kubernetes manifests. We have noticed an instance of no security context in one of your Kubernetes manifests. The recommended practice is use of security context for pods. Without defining a security context for the pod, a container may run with root privilege and write permission into the root file system, making the Kubernetes cluster vulnerable. For examples of Kubernetes security anti-patterns we are following our peer-reviewed publication on Kubernetes security best practices (https://arxiv.org/pdf/2006.15275.pdf).

Location:

run-devops/aks/shoppingapi.yaml

Line 18 in 70a7db4

- name: shoppingapi

Please use securityContext to fix this misconfiguration. We would like to hear if you agree to fix this misconfiguration or have fixed the misconfiguration.

[akondasif]

Dear Colleague,

We are looking to find ways to help developers find security misconfigurations, i.e., violation of security best practices in Kubernetes manifests. We have noticed an instance of HTTP without TLS/SSL in one of your Kubernetes manifests. The recommended practice is use of secure HTTP for each team's development and production environment. Enabling TLS ensures secure communication between cluster components.. For examples of Kubernetes security anti-patterns we are following our peer-reviewed publication on Kubernetes security best practices (https://arxiv.org/pdf/2006.15275.pdf).

Location:

run-devops/aks/shoppingapi-configmap.yaml

Line 6 in 4d328f5

shoppingapi_url: http://shoppingapi-service

Please use SSL/TLS to fix this misconfiguration. We would like to hear if you agree to fix this misconfiguration or have fixed the misconfiguration.