Suture: Stitching Safety onto Kubernetes Operators

Kubernetes operators allow custom automation for applications to be packaged with the application in a cluster-agnostic manner. This unique property eliminates the need for inhouse operational expertise with the application --- such domain knowledge, encoded once, can be distributed to any environment --- but requires trusting the operator to run arbitrary actions across an entire cluster. Little is known about the security or reliability implications of this paradigm. We present results from a survey of 54 Kubernetes developers and an analysis of 215 feature requests against 19 operator repositories demonstrating the ways users have experienced nontrivial safety issues with operators. We further propose the development of Suture, an access-control mechanism that seeks to prevent the majority of these safety issues with operators.