Analyzing and Mitigating (with LLMs) the Security Misconfigurations of Helm Charts from Artifact Hub
Background: Helm is a package manager that allows defining, installing, and upgrading applications with Kubernetes (K8s), a popular container orchestration platform. A Helm chart is a collection of files describing all dependencies, resources, and parameters required for deploying an application within a K8s cluster. Objective: We investigate the common (or unique) misconfigurations found by open-source chart analyzer tools in Helm chart repositories, and whether Large Language Models (LLMs) can recommend correct changes to such misconfigurations, even in the presence of maliciously injected misconfigurations. Method: We propose a pipeline to mine Helm charts from Artifact Hub, a popular centralized repository, and analyze them using state-of-the-art open-source tools, such as Checkov and KICS. First, such a pipeline will identify common and unique misconfigurations. Secondly, it will use LLMs to suggest mitigation for each misconfiguration, and the recommended refactoring will be analyzed again to see whether it satisfies the tools. Finally, it will inject into the charts potentially malicious mitigations (e.g., memory: john instead of memory: 250Mi, or over-privileged pods) and check whether they still satisfy the tool policies and whether LLMs can correctly refactor them. A final manual expert validation on a sub-sample will be used to provide Agresti-Coull-Wilson confidence intervals of the statistical results of the automated pipeline.