The International Conference for High Performance Computing, Networking, Storage, and Analysis
The International Conference for High Performance Computing, Networking, Storage, and Analysis
Workshop: 7th International Workshop on Containers and New Orchestration Paradigms for Isolated Environments in HPC (CANOPIE-HPC)
Authors: Ali Kanso, Slava Oks, Elzeiny Mostafa, and Gurpreet Virdi (Microsoft Corporation)
Abstract: Kubernetes is the de facto standard for container orchestration but was not designed for hostile multi-tenancy. Native constructs such as namespaces, role-based access control, and admission controllers provide logical separation but lack the strong isolation required in adversarial environments. This paper presents a Kubernetes-compatible architecture that integrates per-tenant virtual control planes, hypervisor-backed sandboxes, and automated policy enforcement to achieve secure multi-tenancy. Each tenant receives a dedicated virtual control plane (via vCluster) linked to a virtual node that schedules workloads into VM-based sandboxes (Azure Container Instances), preserving the Kubernetes API experience. A policy engine (Kyverno) hardens namespaces by enforcing network segmentation, resource limits, and strict security contexts at admission time. Evaluation demonstrates that this approach delivers strong inter-tenant isolation with negligible performance overhead, providing a practical model for zero-trust container orchestration in hostile cloud and edge environments.
Back to 7th International Workshop on Containers and New Orchestration Paradigms for Isolated Environments in HPC (CANOPIE-HPC) Archive Listing Back to Full Workshop Archive Listing