Kubernetes security isolation based on classified information and risk levels
One example method includes performing a filtering process that identifies one or more candidate hosts for scheduling of a pod, wherein the candidacy of a host is determined based in part upon an association rule, generating an overall host score for each of the candidate hosts, and scheduling the pod to one of the candidate hosts based on the overall host score of that candidate host. A host risk score and/or pod risk score may be used in the generating of the overall host score.
1. A method, comprising operations that include:
performing a filtering process that identifies one or more candidate hosts for scheduling of a pod, wherein a candidacy of a host is determined based in part upon an association rule;
generating an overall host score for each of the candidate hosts; and
scheduling the pod to one of the candidate hosts based on the overall host score of the candidate host to which the pod was scheduled;
wherein the candidate host to which the pod is scheduled runs on an infrastructure that also supports another host with another pod, and a security classification rank of the pod is different from a security classification rank of the another pod.
2. The method as recited in claim 1 , wherein the association rule correlates a security classification rank of the pod with a required isolation level for the pod.
3. The method as recited in claim 1 , wherein the candidacy of the host is further determined based in part upon a standard criteria score.
4. The method as recited in claim 1 , further comprising determining a respective host risk score for each of the candidate hosts, and/or determining a pod risk score for the pod, and the overall host score is determined based in part on the respective host risk scores and/or the pod risk score.
5. The method as recited in claim 4 , wherein the overall host score is expressed as: overall host score=standard criteria score*pod risk score*host risk score.
6. The method as recited in claim 5 , wherein the standard criteria score indicates an extent to which the host to which the standard criteria score applies has adequate hardware and software resources to support operations of the pod.
7. The method as recited in claim 1 , wherein an isolation level of the pod is different from an isolation level of the another pod.
8. The method as recited in claim 1 , wherein the pod includes one or more containers, and the operations are performed in a container based infrastructure.
9. The method as recited in claim 1 , wherein the operations are performed by a scheduler of a container-based infrastructure.
10. A non-transitory computer readable storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
performing a filtering process that identifies one or more candidate hosts for scheduling of a pod, wherein the candidacy of a host is determined based in part upon an association rule;
generating an overall host score for each of the candidate hosts; and
scheduling the pod to one of the candidate hosts based on the overall host score of that the candidate host to which the pod was scheduled;
wherein the candidate host to which the pod is scheduled runs on an infrastructure that also supports another host with another pod, and a security classification rank of the pod is different from a security classification rank of the another pod.
11. The non-transitory computer readable storage medium as recited in claim 10 , wherein the association rule correlates a security classification rank of the pod with a required isolation level for the pod.
12. The non-transitory computer readable storage medium as recited in claim 10 , wherein the candidacy of the host is further determined based in part upon a standard criteria score.
13. The non-transitory computer readable storage medium as recited in claim 10 , further comprising determining a respective host risk score for each of the candidate hosts, and/or determining a pod risk score for the pod, and the overall host score is determined based in part on the respective host risk scores and/or the pod risk score.
14. The non-transitory computer readable storage medium as recited in claim 13 , wherein the overall host score is expressed as: overall host score=standard criteria score*pod risk score*host risk score.
15. The non-transitory computer readable storage medium as recited in claim 14 , wherein the standard criteria score indicates an extent to which the host to which the standard criteria score applies has adequate hardware and software resources to support operations of the pod.
16. The non-transitory computer readable storage medium as recited in claim 10 , wherein an isolation level of the pod is different from an isolation level of the another pod.
17. The non-transitory computer readable storage medium as recited in claim 10 , wherein the pod includes one or more containers, and the operations are performed in a container based infrastructure.
18. The non-transitory computer readable storage medium as recited in claim 10 , wherein the operations are performed by a scheduler of a container-based infrastructure.