<i>Verikube</i>: Automatic and Efficient Verification for Container Network Policies

Abstract

Recently, Linux Container has been the de-facto standard for a cloud system, enabling cloud providers to create a virtual environment in a much more scaled manner. However, configuring container networks remains immature and requires automatic verification for efficient cloud management. We propose Verikube, which utilizes a novel graph structure representing policies to reduce memory consumption and accelerate verification. Moreover, unlike existing works, Verikube is compatible with the complex semantics of Cilium Policy which a cloud adopts from its advantage of performance. Our evaluation results show that Verikube performs at least seven times better for memory efficiency, at least 1.5 times faster for data structure management, and 20K times better for verification.

Kunerva: Automated Network Policy Discovery Framework for Containers

“…In Kubernetes, for instance, network policies are specified in a declarative way using YAML or JSON configuration files [27]. These files comprise three primary parts: a selector, ingress rules, and egress rules.…”