RL-Admit з підтримкою претрейнінгу: гібридний підхід до безпеки Kubernetes зі збереженням адаптивності

Abstract

Kubernetes dominates container orchestration, yet its dynamic architecture creates significant control-plane security challenges. Static admission controllers like OPA Gatekeeper and Kyverno rely on fixed policies, yielding high false positives and slow adaptation to novel threats. RL-Admit models webhook decisions as a POMDP and applies Proximal Policy Optimization (PPO) for online training, with PAC guarantees of convergence to an ε-optimal policy. The cold-start issue—random initialization causing excessive false denials or undetected attacks—is mitigated by offline pretraining. The hybrid framework supports safe shadow/audit deployment, reduces initial false positives by 15–20×, halves convergence time, and enhances chained and zero-day attack detection.