In a recent warning from Microsoft, it has been highlighted that utilizing pre-made templates, such as out-of-the-box Helm charts, for Kubernetes deployments could potentially lead to misconfigurations and data leaks. Michael Katchinskiy and Yossi Weizman from the Microsoft Defender for Cloud Research team emphasized that these “plug-and-play” options prioritize ease of use over security, resulting in a significant number of applications being deployed with default misconfigurations that expose sensitive data and cloud resources to attackers.
Helm, a package manager for Kubernetes that is part of the Cloud Native Computing Foundation (CNCF), allows developers to package, configure, and deploy applications onto Kubernetes clusters. Kubernetes application packages are structured in the Helm packaging format known as charts, which consist of YAML manifests and templates describing the necessary Kubernetes resources and configurations for deployment.
Microsoft pointed out that open-source projects often include default manifests or pre-defined Helm charts that lack proper network restrictions for external services and authentication or authorization by default. This can inadvertently expose applications to potential attackers, especially when sensitive APIs are queried or administrative actions are permitted.
Projects such as Apache Pinot, Meshery, and Selenium Grid have been identified as examples that could put Kubernetes environments at risk of attacks due to misconfigurations. To mitigate these risks, organizations are advised to review and modify YAML manifests and Helm charts according to security best practices, regularly scan publicly facing interfaces, and monitor running containers for any malicious or suspicious activities.
The researchers emphasized the importance of avoiding “default by convenience” setups, as many real-world exploitations of containerized applications stem from misconfigured workloads. By prioritizing security over convenience and taking proactive measures to secure Kubernetes deployments, organizations can better protect their applications and data from potential threats.
Source link