Automated Kubernetes Workload Hardening Using a Functionality Oracle

Kubernetes is Hard and so is Security.
Let's automate it and make it funky!

Initial situation

Many Kubernetes workloads are deployed with overly permissive security configurations due to uncertainty about which restrictions an application can tolerate. Since security is often an afterthought, operators tend to grant excessive privileges to ensure functionality, leading to potential vulnerabilities.

Problem statement / Project goal

This project introduces an automated system that evaluates the runtime behavior of applications under security constraints, allowing operators to identify the minimal privileges necessary for correct functionality. The result is a hardened workload configuration tailored to the application's real needs.

Solution Approach
                
                During the research phase, existing black box testing approaches were evaluated with a focus on their feasibility
                to determine an applications functionality. Based on the findings, a new approach was developed that relies on
                metrics and logs gathered during the runtime of the application. Using those signals, an iterative process
                is used to determine the minimal privileges necessary for the application to function correctly.
              
Running Checks
                
                For each security constraint, a check is run to determine whether the application still functions correctly. 
                To avoid interference between checks, the source namespace is cloned for each check, and the security constraints 
                are applied to the cloned namespace. 

                Based on the metrics and logs gathered from a check run, a heuristic process determines if the check run was successful.

Solution developed

At the heart of the system is a Kubernetes Operator developed using the Operator SDK. The Operator watches custom resources of type WorkloadHardeningCheck and executes a multi-phase evaluation procedure:

Cloning the workload into a controlled test namespace
Iteratively applying securityContext constraints
Gather runtime signals including logs, container metrics, and process termination status
Determining the functionality of the workload based on the gathered signals and comparing it to the expected behavior

The design preserves the integrity of the original deployment and does not require knowledge of application internals.

Outcome

This project demonstrates that it is feasible to harden Kubernetes workloads automatically, without requiring manual inspection or deep application knowledge. The system can assist DevOps teams and platform engineers in reducing security risks through automation and supports secure-by-default deployment practices.
It is particularly useful in regulated environments or organizations with strict compliance requirements.

Key terms

KubernetesKubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications.
Functionality OracleA mechanism that determines whether a workload remains functional under changing runtime constraints.
Workload HardeningThe process of reducing a workload's privileges and attack surface while maintaining operational functionality.
Runtime EvaluationAssessing workload behavior during execution to infer the most restrictive functional security configuration.

Team

Mathias Petermann

Advisor
Sebastian Graf