Using LSMs to Strengthen Access Control of Applications that use hostPath in Kubernetes Clusters

This paper presents a methodology to enhance the security of Kubernetes clusters using hostPath volumes, a feature that introduces considerable risks due to direct host access. Our approach leverages Linux Security Modules (LSMs) to enforce access control between workloads and host nodes, aligning with Zero Trust principles. The proposed solution is demonstrated through integration with the SPIFFE CSI Driver within the SPIRE framework. Experimental results show that, among various performance metrics, only the SPIRE Agent’s identity synchronization latency increased notably, around 29.68%. While this overhead appears significant, it may be acceptable in less time-sensitive scenarios, particularly when balanced against the improved security posture achieved.