AI-Assisted Multi-Cluster Kubernetes Governance: A Secure, Resilient, and Policy-Driven Framework for Large-Scale Cloud Infrastructure Management
DOI:
https://doi.org/10.63084/algora.v1i02.106Keywords:
Kubernetes, multi-cluster governance, artificial intelligence, policy-as-code, cloud security, infrastructure resilience, computer information systemsAbstract
The growing adoption of Kubernetes has enabled organisations to deploy and manage containerised applications across large-scale cloud environments. However, the transition from single-cluster deployments to distributed multi-cluster infrastructure introduces governance difficulties involving inconsistent policies, fragmented visibility, security misconfigurations, delayed threat detection, and complex recovery procedures. This study aims to design an AI-assisted governance framework for secure, resilient, and policy-driven management of multi-cluster Kubernetes environments. The proposed framework combines centralised cluster registration, policy-as-code enforcement, continuous security monitoring, machine learning-based anomaly detection, predictive resource analysis, and human-controlled automated remediation. A design-science research method is adopted, combining literature analysis, threat modelling, architectural development, and scenario-based evaluation. The evaluation model measures threat-detection time, policy compliance, remediation time, workload recovery, service availability, false-positive rate, and governance overhead. The comparative analysis indicates that existing approaches commonly address orchestration, monitoring, security, policy enforcement, or resource management separately, with limited integration across these functions. The proposed framework addresses this limitation by establishing a unified governance layer that supports consistent policy distribution, cross-cluster observability, risk-based incident prioritisation, and resilient workload placement. Its practical contribution is a reference architecture that cloud administrators can adapt to hybrid-cloud and multi-cloud Kubernetes environments while retaining human oversight of high-risk remediation decisions.
References
1. Burns, B., Grant, B., Oppenheimer, D., Brewer, E., & Wilkes, J. (2016). Borg, omega, and kubernetes. Communications of the ACM, 59(5), 50-57.
2. Carcassi, G., Breen, J., Bryant, L., Gardner, R. W., Mckee, S., & Weaver, C. (2020). SLATE: Monitoring distributed Kubernetes clusters. In Practice and Experience in Advanced Research Computing 2020: Catch the Wave (pp. 19-25).
3. Carrión, C. (2022). Kubernetes scheduling: Taxonomy, ongoing issues and challenges. ACM Computing Surveys, 55(7), 1-37.
4. Combe, T., Martin, A., & Di Pietro, R. (2016). To docker or not to docker: A security perspective. IEEE Cloud Computing, 3(5), 54-62.
5. Combe, T., Martin, A., & Di Pietro, R. (2016). To docker or not to docker: A security perspective. IEEE Cloud Computing, 3(5), 54-62.
6. Dang, Y., Lin, Q., & Huang, P. (2019, May). Aiops: real-world challenges and research innovations. In 2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) (pp. 4-5). IEEE.
7. Du, M., Li, F., Zheng, G., & Srikumar, V. (2017, October). Deeplog: Anomaly detection and diagnosis from system logs through deep learning. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security (pp. 1285-1298).
8. Dumitru-Guzu, O. M., Călin, V., & Kooij, R. (2024). A novel framework for cross-cluster scaling in cloud-native 5G NextGen core. Future Internet, 16(9), 325.
9. Gan, Y., Zhang, Y., Hu, K., Cheng, D., He, Y., Pancholi, M., & Delimitrou, C. (2019, April). Seer: Leveraging big data to navigate the complexity of performance debugging in cloud microservices. In Proceedings of the twenty-fourth international conference on architectural support for programming languages and operating systems (pp. 19-33).
10. Gu, J. T., Sun, X., Zhang, W., Jiang, Y., Wang, C., Vaziri, M., ... & Xu, T. (2023, October). Acto: Automatic end-to-end testing for operation correctness of cloud system management. In Proceedings of the 29th Symposium on Operating Systems Principles (pp. 96-112).
11. Huang, C. K., & Pierre, G. (2023, March). Acala: Aggregate monitoring for geo-distributed cluster federations. In Proceedings of the 38th ACM/SIGAPP Symposium On Applied Computing (pp. 156-164).
12. Iorio, M., Risso, F., Palesandro, A., Camiciotti, L., & Manzalini, A. (2022). Computing without borders: The way towards liquid computing. IEEE Transactions on Cloud Computing, 11(3), 2820-2838.
13. Li, X., Chen, Y., Lin, Z., Wang, X., & Chen, J. H. (2021). Automatic policy generation for {Inter-Service} access control of microservices. In 30th USENIX Security Symposium (USENIX Security 21) (pp. 3971-3988).
14. Liu, B., Lim, G., Beckett, R., & Godfrey, P. B. (2024). Kivi: Verification for cluster management. In 2024 USENIX Annual Technical Conference (USENIX ATC 24) (pp. 509-527).
15. Mao, H., Alizadeh, M., Menache, I., & Kandula, S. (2016, November). Resource management with deep reinforcement learning. In Proceedings of the 15th ACM workshop on hot topics in networks (pp. 50-56).
16. Mao, H., Schwarzkopf, M., Venkatakrishnan, S. B., Meng, Z., & Alizadeh, M. (2019). Learning scheduling algorithms for data processing clusters. In Proceedings of the ACM special interest group on data communication (pp. 270-288).
17. Notaro, P., Cardoso, J., & Gerndt, M. (2021). A survey of aiops methods for failure management. ACM Transactions on Intelligent Systems and Technology (TIST), 12(6), 1-45.
18. Qiu, H., Banerjee, S. S., Jha, S., Kalbarczyk, Z. T., & Iyer, R. K. (2020). {FIRM}: An intelligent fine-grained resource management framework for {SLO-Oriented} microservices. In 14th USENIX symposium on operating systems design and implementation (OSDI 20) (pp. 805-825).
19. Qiu, H., Mao, W., Wang, C., Franke, H., Youssef, A., Kalbarczyk, Z. T., ... & Iyer, R. K. (2023). {AWARE}: Automate workload autoscaling with reinforcement learning in production cloud systems. In 2023 USENIX Annual Technical Conference (USENIX ATC 23) (pp. 387-402).
20. Rahman, A., Shamim, S. I., Bose, D. B., & Pandita, R. (2023). Security misconfigurations in open source kubernetes manifests: An empirical study. ACM Transactions on Software Engineering and Methodology, 32(4), 1-36.
21. Rodriguez, M. A., & Buyya, R. (2019). Container‐based cluster orchestration systems: A taxonomy and future directions. Software: Practice and Experience, 49(5), 698-719.
22. Rossi, F., Nardelli, M., & Cardellini, V. (2019, July). Horizontal and vertical scaling of container-based applications using reinforcement learning. In 2019 IEEE 12th International Conference on Cloud Computing (CLOUD) (pp. 329-338). IEEE.
23. Rzadca, K., Findeisen, P., Swiderski, J., Zych, P., Broniek, P., Kusmierek, J., ... & Wilkes, J. (2020, April). Autopilot. In Proceedings of the Fifteenth European Conference on Computer Systems. ACM.
24. Shamim, S. I. (2021, August). Mitigating security attacks in kubernetes manifests for security best practices violation. In Proceedings of the 29th ACM joint meeting on European software engineering conference and symposium on the foundations of software engineering (pp. 1689-1690).
25. Shamim, M. S. I., Bhuiyan, F. A., & Rahman, A. (2020). Xi commandments of kubernetes security: A systematization of knowledge related to kubernetes security practices. 2020 IEEE Secure Development (SecDev), 58-64.
26. Souppaya, M., Morello, J., & Scarfone, K. (2017). Application container security guide (No. NIST Special Publication (SP) 800-190 (Draft)). National Institute of Standards and Technology.
27. Sultan, S., Ahmad, I., & Dimitriou, T. (2019). Container security: Issues, challenges, and the road ahead. IEEE access, 7, 52976-52996.
28. Sun, X., Luo, W., Gu, J. T., Ganesan, A., Alagappan, R., Gasch, M., ... & Xu, T. (2022). Automatic reliability testing for cluster management controllers. In 16th USENIX Symposium on Operating Systems Design and Implementation (OSDI 22) (pp. 143-159).
29. Tamiru, M. A., Pierre, G., Tordsson, J., & Elmroth, E. (2020, November). Instability in geo-distributed kubernetes federation: Causes and mitigation. In 2020 28th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS) (pp. 1-8). IEEE.
30. Tamiru, M. A., Pierre, G., Tordsson, J., & Elmroth, E. (2021, July). mck8s: An orchestration platform for geo-distributed multi-cluster environments. In 2021 International Conference on Computer Communications and Networks (ICCCN) (pp. 1-10). IEEE.
31. Verma, A., Pedrosa, L., Korupolu, M., Oppenheimer, D., Tune, E., & Wilkes, J. (2015, April). Large-scale cluster management at Google with Borg. In Proceedings of the tenth european conference on computer systems (pp. 1-17).
32. Wu, L., Tordsson, J., Elmroth, E., & Kao, O. (2020, April). Microrca: Root cause localization of performance issues in microservices. In IEEE/IFIP Network Operations and Management Symposium (NOMS).
33. Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., ... & Zhang, D. (2019, August). Robust log-based anomaly detection on unstable log data. In Proceedings of the 2019 27th ACM joint meeting on European software engineering conference and symposium on the foundations of software engineering (pp. 807-817).
34. Zhang, Y., Hua, W., Zhou, Z., Suh, G. E., & Delimitrou, C. (2021, April). Sinan: ML-based and QoS-aware resource management for cloud microservices. In Proceedings of the 26th ACM international conference on architectural support for programming languages and operating systems (pp. 167-181).
35. Zhong, Z., Xu, M., Rodriguez, M. A., Xu, C., & Buyya, R. (2022). Machine learning-based orchestration of containers: A taxonomy and future directions. ACM Computing Surveys (CSUR), 54(10s), 1-35.
