Service Does Not Target Pod

• Query id: 3ca03a61-3249-4c16-8427-6f8e47dda729
• Query name: Service Does Not Target Pod
• Platform: Kubernetes
• Severity: Low
• Category: Insecure Configurations
• CWE: 665
• URL: Github

Description

Service should Target a Pod
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - yaml file

apiVersion: v1
kind: Service
metadata:
  name: helloworld2
spec:
  type: NodePort
  selector:
    app: helloworld2
  ports:
    - name: http
      nodePort: 30475
      port: 9377
      protocol: TCP
      targetPort: 9377
---
apiVersion: v1
kind: Pod
metadata:
  name: nginx2
  labels:
    app: hellowwwworld
spec:
  containers:
    - name: nginx
      image: nginx
      ports:
        - containerPort: 9377

Positive test num. 2 - yaml file

apiVersion: v1
kind: Service
metadata:
  name: helloworld3
spec:
  type: NodePort
  selector:
    app: helloworld3
  ports:
    - name: http
      nodePort: 30475
      port: 9377
      protocol: TCP
      targetPort: 9377
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: helloworld3
spec:
  replicas: 3
  selector:
    matchLabels:
      app: helloworld3
  template:
    metadata:
      labels:
        app: helloworld3
    spec:
      containers:
        - name: nginx
          image: nginx:1.14.2
          ports:
            - containerPort: 80

Code samples without security vulnerabilities

Negative test num. 1 - yaml file

apiVersion: v1
kind: Service
metadata:
  name: helloworld
spec:
  type: NodePort
  selector:
    app: helloworld
  ports:
    - name: http
      nodePort: 30475
      port: 8089
      protocol: TCP
      targetPort: 8089

---

apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    app: helloworld
spec:
  containers:
  - name: nginx
    image: nginx
    ports:
      - containerPort: 8089

Negative test num. 2 - yaml file

apiVersion: v1
kind: Service
metadata:
  name: negative2
spec:
  type: ClusterIP
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 8080
    - name: health
      port: 8081
      protocol: TCP
      targetPort: 8082
  selector:
    app: negative2
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: negative2
  labels:
    app: negative2
spec:
  selector:
    matchLabels:
      app: negative2
  template:
    metadata:
      labels:
        app: negative2
    spec:
      containers:
        - name: webserver
          image: nginx:latest
          ports:
            - containerPort: 8080
            - containerPort: 8082

Negative test num. 3 - yaml file

apiVersion: v1
kind: Service
metadata:
  name: negative3
spec:
  type: NodePort
  selector:
    app: negative3
  ports:
    - name: http
      nodePort: 30475
      port: 9377
      protocol: TCP
      targetPort: web
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: negative3
spec:
  replicas: 3
  selector:
    matchLabels:
      app: negative3
  template:
    metadata:
      labels:
        app: negative3
    spec:
      containers:
        - name: nginx
          image: nginx:1.14.2
          ports:
            - name: web
              containerPort: 80

Negative test num. 4 - yaml file

apiVersion: v1
kind: Service
metadata:
  name: negative4
spec:
  selector:
    app: negative4
    tier: backend
  ports:
  - protocol: TCP
    port: 80
    targetPort: http
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend
spec:
  selector:
    matchLabels:
      app: negative4
      tier: backend
      track: stable
  replicas: 3
  template:
    metadata:
      labels:
        app: negative4
        tier: backend
        track: stable
    spec:
      containers:
        - name: negative4
          image: "gcr.io/google-samples/hello-go-gke:1.0"
          ports:
            - name: http
              containerPort: 80

Negative test num. 5 - yaml file

apiVersion: v1
kind: Service
metadata:
  name: negative5
spec:
  selector:
    app: negative5
    tier: backend
  ports:
  - protocol: TCP
    port: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend
spec:
  selector:
    matchLabels:
      app: negative5
      tier: backend
      track: stable
  replicas: 3
  template:
    metadata:
      labels:
        app: negative5
        tier: backend
        track: stable
    spec:
      containers:
        - name: negative5
          image: "gcr.io/google-samples/hello-go-gke:1.0"
          ports:
            - name: http
              containerPort: 80

Negative test num. 6 - yaml file

apiVersion: v1
kind: Service
metadata:
  name: helloworld
spec:
  type: NodePort
  selector:
    app: helloworld
  ports:
    - name: http
      nodePort: 30475
      port: 8089
      protocol: TCP
      targetPort: 8089
---
apiVersion: v1
kind: Pod
metadata:
  name: nginx3
  labels:
    app: helloworld
spec:
  containers:
  - name: nginx
    image: nginx
    ports:
      - containerPort: 808
---
apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    app: helloworld
spec:
  containers:
  - name: nginx
    image: nginx
    ports:
      - containerPort: 8089