- Microsoft Security Blog warns Kubernetes users on the helm charts with default settings
- These settings often come with open gates, weak credentials and other risks
- Microsoft calls on Kubernetes users to review their settings
Kubernetes HELM charts can postpone data without users ever knowing, Microsoft Security researchers have warned and encouraged Kubernetes users to be careful and review the standard configuration of their raw diagrams.
Kubernetes is an open source platform for automation of implementation, scaling and control of containerized applications. Helm, on the other hand, is a package handling that simplifies the implementation and control of applications on Kubernetes using pre -configured templates called diagrams.
It allows users to define, install and upgrade complex cubes -nets applications with minimal manual configuration.
Standard configurations
In a new blog post, entitled “The Risk of Standard Configuration: How Out-of-the-Box held hands can break your cluster,” writers Michael Katchinskiy and Yossi Weizman require that in many cases no approval holds certain gates open and uses easy to-guess or hard-coded passwords.
This happens when HELM charts are implemented with default settings, which is often the case with inexperienced cloud users.
“Standard configurations that lack proper security control create a serious security threat,” the blog reads. “Without carefully reviewing the Yaml manifested and held diagrams, organizations can unconsciously implement services that lack any kind of protection, leaving them fully exposed to attackers.”
Katchinskiy and Weizman added that the risk “in particular” when the implemented apps can ask sensitive API or allow administrative actions. “
The designated three cases where Helm charts put the whole cubes -— environments in danger -Apache Pinot, Meshery and Selenium Grid.
The best way to mitigate the risk is to be careful when implementing rudder, not using standard configurations and evaluating the setup from a security perspective to ensure it includes approval and network insulation.
Furthermore, Microsoft recommends the users who run regular scans for misunderstandings that may expose interfaces to the public and keep an eye on containers for unjustified activity.
Via Bleeping computer
