Kano: Efficient Container Network Policy Verification
Yifan Li, Chengjun Jia, Xiaohe Hu, Jun Li · 2020
Container technology is a light weight back-end virtualization solution which copes with the growing demand for internet service concurrency. For security and availability, network isolation is essential in container network. Label based network access control policies are employed as a network isolation solution by the famous container orchestrator, Kubernetes. The large scale and flexibility of container networks implies a prohibitive complexity, whereas the constant changes of policies and containers demand a short response time, thus the policy verification needs to be efficient. However, there is no existing tool that solves the verification problem of label based network access control policies. Kano is proposed as the first system to cover container network policy verification, including incremental verification. It leverages on a prefiltration algorithm to reduce the time complexity of reachability matrix calculation from O(n2) to O(n). With predefined and user-defined constraints which can be verified quickly with the reachability matrix, Kano removes potential risk from the container network. Based on the verification result, Kano provides advices to reinforce the security and availability of the container network.