Security Misconfiguration: HTTP Without TLS

[akondasif]

Dear Colleague,

We are looking to find ways to help developers find security misconfigurations, i.e., Kubernetes manifest configurations that violate security best practices for Kubernetes manifests.

We have noticed an instance of HTTP without TLS/SSL in one of your Kubernetes manifests. The recommended practice is use of secure HTTP for each team's development and production environment. Enabling TLS ensures secure communication between cluster components. Otherwise, the communication could susceptible to man in the middle attacks.

Location of security anti-pattern:

ultimate-stack/kubernetes/dev/mcs/tickets-depl.yaml

Line 33 in 5b94132

value: "http://nats-srv:4222"

and

ultimate-stack/kubernetes/dev/dev-dbs/auth-mongo-depl.yaml

Line 8 in 5b94132

replicas: 1

Please use SSL/TLS to fix this misconfiguration. We would like to hear if you agree to fix this misconfiguration or have fixed the misconfiguration.