Automated Kubernetes workload hardening using a functionality oracle
Sebastian Graf
Mathias Petermann
16:00 - 16:45
Uptown
Kubernetes allows workloads to be deployed in sandboxed environments using containerization, offering fine-grained runtime restrictions via securityContext configurations. However, determining whether an application continues to function correctly under increasingly restrictive settings remains a challenge, especially since conventional testing methodologies require application-specific knowledge. This talk presents a methodology for automated workload hardening, without requiring internal knowledge of the workload under test. By relying on a recorded baseline utilizing telemetry signals such as logs and metrics, cloned workloads are continuously checked and adapted. We will show how the orakel of funk, integrated seamlessly into Kubernetes workflows, reduces trial-and-error deployments while providing actionable hardening recommendations to improve security without slowing down developers.