Securing Pods in a Container Orchestration Environment

A computer system for securing pods in a container orchestration environment, the computer system comprising:

• a bus system;
• a storage device connected to the bus system, wherein the storage device stores program instructions;
• and
• a processor connected to the bus system, wherein the processor executes the program instructions to:
• verify, using an agent embedded in a trusted execution environment of the computer system, a container runtime interface command to perform an orchestration action on a set of containers comprising an application workload that corresponds to a service hosted by the container orchestration environment based on matching the container runtime interface command to a rule contained in a trusted execution environment contract included in a pod sandbox virtual machine of the trusted execution environment;
• determine, using the agent, whether the container runtime interface command to perform the orchestration action on the set of containers is valid based finding a matching rule in the trusted execution environment contract;
• and
• execute, using the agent, the container runtime interface command to perform the orchestration action on the set of containers comprising the application workload that corresponds to the service in the pod sandbox virtual machine of the trusted execution environment in response to determining, using the agent, that the container runtime interface command to perform the orchestration action on the set of containers is valid based on finding the matching rule in the trusted execution environment contract.

A computer program product for securing pods in a container orchestration environment, the computer program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method of:

• verifying, by the computer, using an agent embedded in a trusted execution environment of the computer, a container runtime interface command to perform an orchestration action on a set of containers comprising an application workload that corresponds to a service hosted by the container orchestration environment based on matching the container runtime interface command to a rule contained in a trusted execution environment contract included in a pod sandbox virtual machine of the trusted execution environment;
• determining, by the computer, using the agent, whether the container runtime interface command to perform the orchestration action on the set of containers is valid based finding a matching rule in the trusted execution environment contract;
• and
• responsive to the computer determining, using the agent, that the container runtime interface command to perform the orchestration action on the set of containers is valid based on finding the matching rule in the trusted execution environment contract, executing, by the computer, using the agent, the container runtime interface command to perform the orchestration action on the set of containers comprising the application workload that corresponds to the service in the pod sandbox virtual machine of the trusted execution environment.

A method for securing pods, the method comprising:

• verifying a container runtime interface command to perform an orchestration action on a set of containers comprising an application workload that corresponds to a service based on matching the container runtime interface command to a rule contained in a trusted execution environment contract included in a pod sandbox virtual machine of a trusted execution environment;
• determining whether the container runtime interface command to perform the orchestration action on the set of containers is valid based finding a matching rule in the trusted execution environment contract;
• and
• responsive to determining that the container runtime interface command to perform the orchestration action on the set of containers is valid based on finding the matching rule in the trusted execution environment contract, executing the container runtime interface command to perform the orchestration action on the set of containers comprising the application workload that corresponds to the service in the pod sandbox virtual machine of the trusted execution environment.