‘Under-reported’ Security Defects in Kubernetes Manifests

Fog computing (also known as edge computing) is a decentralized computing architecture that seeks to minimize service latency and average response time in IoT applications by providing compute and network services physically close to end-users. Fog environment consists of a network of fog nodes and IoT applications are composed of containerized microservices communicating with each other. Due to limited resources of fog nodes, it is often not possible to deploy all the containers of an application on a single fog node. Therefore, communicating containers need to be distributed on multiple fog nodes. Distribution and management of containerized IoT applications is always a critical issue to the system performance in a fog environment. Kubernetes, an open-source system, has grown into a container orchestration standard by simplifying the deployment and management of containerized applications. Despite the progress made by the academia and industry with respect to container management and the wide-scale acceptance of Kubernetes in cloud environments, container management in fog environment is still in the early stage in terms of research and practical deployment. This article aims to fill this gap by analyzing the expediency of Kubernetes container orchestration tool in the fog computing model. The paper also highlights limitations with the current Kubernetes approach and provide ideas for further research to adapt to the needs of the fog environment. Lastly, we provide experiments that demonstrate the feasibility and industrial practicality of deploying and managing containerized IoT applications in the fog computing environment.

Docker as the representative container technology promotes the rapid development of container cloud with its flexible, efficient and fast characteristics. As a better resource virtualization technology, container is widely recognized and favored by the industry. The resource scheduling strategy in the container cloud has an important impact on the cluster performance. The default priorities strategy of Kubernetes container orchestration tool only considers CPU and memory. With the complexity of the production environment, only considering the above two factors in the priorities stage can easily lead to some node load imbalance, which is difficult to guarantee the cluster service performance. In order to balance the resources of container clusters, this paper proposes a new priorities stage strategy based on Kubernetes' default scheduling strategy, which takes the storage and network bandwidth of task nodes into account, then calculates the weight of each resource, and finally puts it into the scoring formula as the basis of resource scheduling. By comparing the load balancing rate of the default priorities scheduling algorithm and the improved priorities scheduling algorithm, it is verified that the improved container cloud resource scheduling strategy can make the load of the task nodes in the cluster more balanced.

Cloud Computing is online technology where computing resources like hardware, software and applications are available as per the user's needs. A cloud computing architecture microservices-based application involves multiple microservices deployed, updated, and redeployed on lightweight virtualization technology called docker container rather than hypervisor-based virtualization. Docker Swarm, Kubernetes and Apache Mesos are container orchestration tool for scheduling and managing individual Container for microservice application within a cluster of private cloud and public cloud. Docker container orchestration can include creating and scheduling Container, availability of container and the host machine, rescheduling of failed Container, scaling of Container to balance the workload on infrastructure and securing the interaction between Container. This survey provides a complete description of docker container orchestration approaches with containers, analyzing the framework and classification of container orchestration management.KeywordsDockerContainerOrchestrationMicro-services

Nowadays, Kubernetes is an advanced container orchestration tool due to its high reliability, scalability and fault tolerance. However, Kubernetes requires a significant number of resources for its work. Therefore, to ensure the operation of Kubernetes in conditions of limited resources, lightweight analogues such as MicroKubernetes and K3S were created. These platforms provide easier deployment and support. In this paper, the authors analyze performance metrics for orchestration actions such as adding/removing nodes and starting/stopping deployments in terms of resource utilization, cluster startup speed, and consumed time for lightweight platforms and original Kubernetes. The results show that the original Kubernetes outperforms MicroKubernetes and K3S in many tests, but K3S demonstrates better disk utilization. On the other hand, MicroKubernetes demonstrates worst results in the performed tests.

Containerization technology utilizes operating system level virtualization to package applications to run with required libraries and are isolated from other processes on the same host. Lightweight and quick deployment make containers popular in many data centers. Running distributed applications in data centers usually involves multiple clusters of machines. Docker Swarm is a container orchestration tool for managing a cluster of Docker containers and their hosts. However, Docker Swarm’s scheduler does not consider resource utilization when placing containers in a cluster. This paper first investigated performance interference in container clusters. Our experimental study showed that distributed applications’ performance can be degraded when co-located with other containers which aggressively consume resources. A new scheduler is proposed to improve performance while keeping high resource utilization. The experimental results demonstrated that the proposed prototype with machine learning based clustering algorithms could effectively improve distributed applications’ performance by up to 14.5% with an average at around 12%. This work also provides theoretical bounds for the container placement problem.

Container orchestration frameworks play a critical role in modern cloud computing paradigms such as cloud-native or serverless computing. They significantly impact the quality and cost of service deployment as they manage many performance-critical tasks such as container provisioning, scheduling, scaling, and networking. Consequently, a comprehensive performance assessment of container orchestration frameworks is essential. However, until now, there is no benchmarking approach that covers the many different tasks implemented in such platforms and supports evaluating different technology stacks. In this paper, we present a systematic approach that enables benchmarking of container orchestrators. Based on a definition of container orchestration, we define the core requirements and benchmarking scope for such platforms. Each requirement is then linked to metrics and measurement methods, and a benchmark architecture is proposed. With COFFEE, we introduce a benchmarking tool supporting the definition of complex test campaigns for container orchestration frameworks. We demonstrate the potential of our approach with case studies of the frameworks Kubernetes and Nomad in a self-hosted environment and on the Google Cloud Platform. The presented case studies focus on container startup times, crash recovery, rolling updates, and more.

This paper describes service clouds, a distributed infrastructure designed to facilitate rapid prototyping and deployment of adaptive communication services. The infrastructure combines adaptive middleware functionality with an overlay network substrate in order to support dynamic instantiation and reconfiguration of services. The service clouds architecture includes a collection of low-level facilities that can be invoked directly by applications or used to compose more complex services. After describing the service clouds architecture, we present results of experimental case studies conducted on the PlanetLab Internet testbed alone and a mobile computing testbed.

This chapter aims to develop an understanding of sensor networks and the security threats posed to them, owing to the inherently insecure wireless nature. It also highlights the current security issues associated with the exchange of information and presents respective countermeasures that can be used to secure the network of malevolent behavior. It builds the reader's understanding of security threats by presenting an idealistic security mechanism and comparing it to currently practiced security mechanisms. Doing so, it identifies the security flaws in each mechanism, henceforth, enumerating a list of well-known security attacks that are connected to the respective security flaws. To provide a better understanding of security threats, the security attacks, in general, are discussed in the perspective of a network administrator, and an adversary. Their impact is also considered from the side of a network administrator and its respective benefits to the adversary. The chapter is later concluded along with future directives and an insight on requirements of forthcoming technologies.

In an information system, applications often make use of services that they access using the parameters described in their configuration files. Various applications then use different codes to denote the same parameters. When access parameters of a service are modified, it is necessary to update them in every configuration file using them. These changes are necessary, for example because of security policies involving regular changes of passwords, or departure of some system administrators. The database password could be changed for example. When system administrators can not immediately identify all services affected by a change or when they feel they don’t have the skills to edit these files, these parameters remain unchanged, creating critical security flaws. This was observed in more than 80% of the organizations we studied. It then becomes necessary to ensure automatic synchronization of all affected files when changing certain settings. Conventional synchronization solutions are difficult to apply when the relevant applications have already been developed by third parties. In this paper, we propose and implement a solution to automatically update all configuration files affected by a change, respecting their structure and codification. It combines a parameters database, a mapping between the configuration files parameters codes and those of the database, and templates for the generation of files. It achieves the objective for all non-encrypted configuration files.

The network functions virtualization (NFV) advent is making way for the rapid deployment of network services (NS) for telecoms. Automation of network service management is one of the main challenges currently faced by the NFV community. Explicitly defining a process for the design, deployment, and management of network services and automating it is therefore highly desirable and beneficial for NFV systems. The use of model-driven orchestration means has been advocated in this context. As part of this effort to support automated process execution, we propose a process enactment approach with NFV systems as the target application domain. Our process enactment approach is megamodel-based. An integrated process modelling and enactment environment, MAPLE, has been built into Papyrus for this purpose. Process modelling is carried out with UML activity diagrams. The enactment environment transforms the process model to a model transformation chain, and then orchestrates it with the use of megamodels. In this paper, we present our approach and environment MAPLE, its recent extension with new features as well as application to an enriched case study consisting of NS design and onboarding process.

It is our great pleasure to welcome you to the 2nd ACM SIGCOMM Workshop on Programmable Routers for Extensible Services of TOmorrow -- PRESTO'09. There continues to be great interest in the networking research community in re-architecting the distribution of functions in IP networks. These efforts can be described as a dis-aggregation of router and switch functionality into various components and well-defined interfaces, towards the goals of deploying richer services and easing management of the network. Efforts in this space span the range from more sophisticated configuration interfaces, to open application programming interfaces (APIs) that allow specialized control and data plane functions on commercial routers, to open software, open firmware, and open hardware platforms that enable tremendous flexibility in the functionality of network equipment. While these open interfaces continue to evolve, many have reached a level of maturity that allow practitioners to create holistic network-centric functions and services by leveraging the available low-level per-device mechanisms. Indeed, programmable network elements hold the promise of accelerating innovation and service deployment. At the same time, programmability could exacerbate already challenging network management tasks. The PRESTO workshop provides a forum for the exchange of ideas between researchers and industry practitioners, with a goal of driving service innovation in IP networks using novel extensible router and switch architectures. The call for papers attracted 23 submissions from Asia, Canada, Europe, and the United States. The program committee accepted 12 papers that cover a variety of topics including primitives for service creation and measurement, data path programmability, platform refactoring, network configuration, and network management. In addition, each session of the program includes a mini-panel aimed at stimulating discussion and providing a broader perspective. We hope that these proceedings will serve as a valuable reference for researchers and developers interested in programmable router architectures.

This paper describes Service Clouds, a distributed infrastructure designed to facilitate rapid prototyping and deployment of services that enhance communication performance, robustness, and security. The infrastructure combines adaptive middleware functionality with an overlay network substrate in order to support dynamic instantiation and reconfiguration of services. The Service Clouds architecture includes a collection of low-level facilities that can be either invoked directly by applications or used to compose more complex services. After describing the Service Clouds architecture, we present results of two experimental case studies conducted on the PlanetLab Internet testbed, the first to improve throughput of bulk data transfer, and the second to enhance the robustness of multimedia streaming

Cloud-native computing is a software development approach that uses cloud computing to build and run scalable applications by leveraging best practices and technologies in the field such as DevOps, general unified architectures (e.g., based on serverless functions, containers, container orchestrators, sidecar, service meshes, microservices), agile software development and so on. It is also used for application development environments that enable an abstraction layer on top of non-cloud provider services. Cloud-native is expected to increase the efficiency of development, operation, and verification of 5G and beyond network functionalities along with automated service upgrades and deployments, and ultimately reduce vendor lock-in so that applications can be easily migrated to other environments seemlessly. In this paper, we provide a state-of-the-art overview of existing cloud-native approaches for telcos, their key features, the role of open-source and Linux Foundation projects, and all associated standardization efforts. After presenting key findings of the recent research studies and related implications under “Lessons Learned”, we highlight the potential challenges, current issues, and future directions of cloud-native computing for telecommunication networks.

The organizers of the ground infrastructure of civil aviation and its current state are comprehensively analyzed and assessed, unresolved problems are identified. The purpose of the article is to develop the transport system as a whole and air transport, which is an important area, which is a prerequisite for the implementation of the innovative model of economic growth in Azerbaijan, as well as an important factor in improving the well-being of the population and the economy as a whole. The object of the research is the service infrastructure that uses the existing advantages of increasing the competitiveness of the national economy (fast delivery of passengers and cargo, no road construction, the ability to get to any point, etc.). The research method is modern methods and technologies of scientific knowledge, methods and techniques for conducting scientific research, tools for system, complex, economic analysis, principles of transport system management, which allow revising existing approaches in modern economic conditions. The hypothesis of the research was the assumption of the possibility of determining the logic of cognition of the process of managing transport potential in modern conditions. The statement of basic materials. It is proven that air transport is used in the study purposefully. It is confirmed that the importance of air transport infrastructure in the implementation of the innovative model of economic growth of Azerbaijan is very important given the preservation of the integrity and security of the country's territory in order to improve the quality of life of the population. In conclusion, proposals were made in the direction of improving the management of air transport infrastructure. The originality and practical significance of the study is confirmed by the stated priority of air transport development. Conclusions and prospects for further research consist in the implementation of a radical increase in competitiveness compared to other modes of transport, and for this reason, improving the management of air transport infrastructure has now become very relevant. Therefore, the formation of an effective development of special programs for the management of air transport infrastructure is a priority of the national economy. Further research will be aimed at developing special programs for the management of air transport infrastructure, based on the scope of their regional location

With the emerging commercial deployments of 5G Network, the Mobile Network Operators (MNOs) will be able to offer more significant network capabilities such as efficient ultra-reliable and low latency communications (URLLC), higher bandwidth for data transfer with enhanced Mobile Broadband (eMBB), and massive capacity to connect devices with massive Internet of Things (mIoT). MNOs are making huge investments to setup 5G Networks with an anticipation of growth in their revenues. However, MNOs may not see the return of investment through end user consumer base alone and may need additional revenue streams. Thus, 5G system has been designed to have advanced built-in features such as network slicing and edge computing, considering requirements from enterprise segments or vertical industries including healthcare, automotive, smart factories, mission critical communications, etc. To enable more rapid deployment of vertical services, the 5G deployments require fostering innovation at the application layer. With the growing needs of verticals industries, the operators are now focusing on enabling standards for vertical applications in 3 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">rd</sup> Generation Partnership Project (3GPP), a global standards forum for 5G. In this paper, the authors explain the Service Enabler Architecture Layer (SEAL) standard for 5G verticals and the services offered by the enabler layer. The paper also elaborates how the operators can leverage the SEAL to quickly develop and deploy vertical applications over the 5G Network.