Abstract
Today’s industry has gradually realized the importance of lifting efficiency and saving costs during the life-cycle of an application. In particular, we see that most of the cloud-based applications and services often consist of hundreds of micro-services; however, the traditional monolithic pattern is no longer suitable for today’s development life-cycle. This is due to the difficulties of maintenance, scale, load balance, and many other factors associated with it. Consequently, people switch their focus on containerization—a lightweight virtualization technology. The saving grace is that it can use machine resources more efficiently than the virtual machine (VM). In VM, a guest OS is required to simulate on the host machine, whereas containerization enables applications to share a common OS. Furthermore, containerization facilitates users to create, delete, or deploy containers effortlessly. In order to manipulate and manage the multiple containers, the leading Cloud providers introduced the container orchestration platforms, such as Kubernetes, Docker Swarm, Nomad, and many others. In this paper, a rigorous study on Kubernetes from an administrator’s perspective is conducted. In a later stage, serverless computing paradigm was redefined and integrated with Kubernetes to accelerate the development of software applications. Theoretical knowledge and experimental evaluation show that this novel approach can be accommodated by the developers to design software architecture and development more efficiently and effectively by minimizing the cost charged by public cloud providers (such as AWS, GCP, Azure). However, serverless functions are attached with several issues, such as security threats, cold start problem, inadequacy of function debugging, and many other. Consequently, the challenge is to find ways to address these issues. However, there are difficulties and hardships in addressing all the issues altogether. Respectively, in this paper, we simply narrow down our analysis toward the security aspects of serverless. In particular, we quantitatively measure the success probability of attack in serverless (using Attack Tree and Attack–Defense Tree) with the possible attack scenarios and the related countermeasures. Thereafter, we show how the quantification can reflect toward the end-to-end security enhancement. In fine, this study concludes with research challenges such as the burdensome and error-prone steps of setting the platform, and investigating the existing security vulnerabilities of serverless computing, and possible future directions.














Similar content being viewed by others
Notes
Namespace encapsulates the Kernel’s global resources, so that each namespace can have an independent and isolated resource sets. It helps ensure different processes to use the same resource in their namespaces without interfering with each other.
Docker Hub is a registry service on the cloud that allows developers to download Docker images that are built by other communities.
Pods is a collection of containers whose functions are highly related.
Volume is a store technique, which maps local file to container’s directory. It enables developers to modify local code and dynamic update the container.
Ubuntu https://ubuntu.com/
Kubernetes The Hard Way https://github.com/kelseyhightower/kubernetes-the-hard-way
Vagrant is automatic tool for creating and managing multiple VMs at the same time.
CoreDNS is a DNS server. It is written in Go. It can be used in a multitude of environments because of its flexibility.
High availability: HA means that developers usually create more than one node for some services to prevent the emergency. If one node breaks down, then other nodes can back up and work.
Grafana Dashboard https://grafana.com/grafana/dashboards
Abbreviations
- AWS :
-
Amazon Web Service
- ASAP :
-
Autonomous System Adaptation Platform
- CAS :
-
Content-Addressable Storage
- CI :
-
Continuous Integration
- CD :
-
Continuous Deployment
- CLI :
-
Command Line Interface
- CNI :
-
Container Network Interface
- CA :
-
Certificate Authority
- DRIP :
-
Dynamic Real-time Infrastructure Planner
- FaaS :
-
Function as a Service
- GCP :
-
Google Cloud Platform
- HA :
-
High Availability
- IoT :
-
Internet Of Thing
- IFC :
-
Information Flow Control
- IaaS :
-
Infrastructure as a Service
- K8S :
-
Kubernetes
- HPA :
-
Horizontal Pod Autoscaler
- MPSC :
-
Multi-Provider Serverless Computing
- P2P :
-
Peer-to-Peer
- SaaS :
-
Software as a Service
- SWITCH :
-
Software Workbench for Interactive, Time Critical and Highly self-adaptive Cloud applications
- SLO :
-
Service-Level Objective
- SIDE :
-
SWITCH Interactive Development Environment
- VM :
-
Virtual Machine
- ATree :
-
Attack Tree
- ADTree :
-
Attack–Defense Tree
References
Naik N (2016) Building a virtual system of systems using docker swarm in multiple clouds. In: 2016 IEEE International Symposium on Systems Engineering (ISSE), IEEE, pp 1–3
Guerrero C, Lera I, Juiz C (2018) Resource optimization of container orchestration: a case study in multi-cloud microservices-based applications. The Journal of Supercomputing 74(7):2956–2983
Cérin C, Menouer T, Saad W, Abdallah WB (2017) A new docker swarm scheduling strategy. In: 2017 IEEE 7th International Symposium on Cloud and Service Computing (SC2), IEEE, pp 112–117
Soppelsa F, Kaewkasi C (2016) Native docker clustering with swarm. Packt Publishing Ltd
Burns B, Grant B, Oppenheimer D, Brewer E, Wilkes J (2016) Borg, omega, and kubernetes: lessons learned from three container-management systems over a decade. Queue 14(1):70–93
Bernstein D (2014) Containers and cloud: from lxc to docker to kubernetes. IEEE Cloud Computing 1(3):81–84
Ifrah S (2019) Deploy a containerized application with amazon EKS. In: Deploy Containers on AWS, Springer, pp 135–173
Bisong E (2019) Containers and google kubernetes engine. In: Building Machine Learning and Deep Learning Models on Google Cloud Platform, Springer, pp 655–670
Ifrah S (2021) Deploy containerized applications with google kubernetes engine (GKE). In: Getting Started with Containers in Google Cloud Platform, Springer, pp 105–135
Orchestration C, Buchanan S, Rangama J, Bellavance N (2019) Introducing Azure Kubernetes Service. Springer, Berline
Baldini I, Castro P, Chang K, Cheng P, Fink S, Ishakian V, Mitchell N, Muthusamy V, Rabbah R, Slominski A, et al. (2017) Serverless computing: current trends and open problems. In: Research Advances in Cloud Computing, Springer, pp 1–20
Mohanty SK, Premsankar G, Di Francesco M, et al. (2018) An evaluation of open source serverless computing frameworks. In: CloudCom, pp 115–120
Back T, Andrikopoulos V (2018) Using a microbenchmark to compare function as a service solutions. In: European Conference on Service-Oriented and Cloud Computing, Springer, pp 146–160
Fox GC, Ishakian V, Muthusamy V, Slominski A (2017) Status of serverless computing and function-as-a-service (faas) in industry and research. arXiv preprint arXiv:170808028
Shahrad M, Balkind J, Wentzlaff D (2019) Architectural implications of function-as-a-service computing. In: Proceedings of the 52nd Annual IEEE/ACM International Symposium on Microarchitecture, pp 1063–1075
Schneier B (1999) Attack trees. Dr Dobb’s journal 24(12):21–29
Schneier B (2015) Secrets and lies: digital security in a networked world. Wiley, NewYork
Kordy B, Mauw S, Radomirović S, Schweitzer P (2014) Attack-defense trees. J Logic Comput 24(1):55–87
Audinot M, Pinchinat S, Kordy B (2017) Is my attack tree correct? In: European Symposium on Research in Computer Security, Springer, pp 83–102
Roy A, Kim DS, Trivedi KS (2012) Attack countermeasure trees (ACT): towards unifying the constructs of attack and defense trees. Security Commun Netw 5(8):929–943
Kordy P, Schweitzer P (2012) The ADTool Manual. University of Luxembourg
Kordy B, Kordy P, Mauw S, Schweitzer P (2013) ADTool: security analysis with attack–defense trees. In: International conference on quantitative evaluation of systems, Springer, pp 173–176
Gadyatskaya O, Jhawar R, Kordy P, Lounis K, Mauw S, Trujillo-Rasua R (2016) Attack trees for practical security assessment: ranking of attack scenarios with ADTool 2.0. In: International Conference on Quantitative Evaluation of Systems, Springer, pp 159–162
Kubernetes\(\_\)Official\(\_\)Documentation (2021) What is Kubernetes? https://kubernetes.io/docs/concepts/overview/what-is-kubernetes/
Grider S (2019) Docker and kubernetes: the complete guide https://www.udemy.com/course/docker-and-kubernetes-the-complete-guide/learn/lecture/11437326#overview
Hightower K, Burns B, Beda J (2017) Kubernetes: up and running: dive into the future of infrastructure. “ O’Reilly Media, Inc.”
Truyen E, Van Landuyt D, Preuveneers D, Lagaisse B, Joosen W (2019) A comprehensive feature comparison study of open-source container orchestration frameworks. Appl Sci 9(5):931
Al Jawarneh IM, Bellavista P, Bosi F, Foschini L, Martuscelli G, Montanari R, Palopoli A (2019) Container orchestration engines: a thorough functional and performance comparison. In: ICC 2019-2019 IEEE International Conference on Communications (ICC), IEEE, pp 1–6
Acuña P (2016) Amazon EC2 container service. Deploying rails with docker. Springer, Kubernetes and ECS, pp 69–98
Ifrah S (2019) Deploying containerized applications with amazon ECS. In: Deploy Containers on AWS, Springer, pp 83–133
Pousty S, Miller K (2014) Getting Started with OpenShift: a Guide for Impatient Beginners. “ O’Reilly Media, Inc.”
Lossent A, Peon AR, Wagner A (2017) PaaS for web applications with OpenShift Origin. In: J Phys: Conf Series, IOP Publishing, vol 898, p 082037
Aly M, Khomh F, Yacout S (2018) Kubernetes or openShift? Which technology best suits eclipse hono IoT deployments. In: 2018 IEEE 11th Conference on Service-Oriented Computing and Applications (SOCA), IEEE, pp 113–120
MANGAT M (2021) Best container orchestration tools for 2020 https://phoenixnap.com/blog/container-orchestration-tools
Pan Y, Chen I, Brasileiro F, Jayaputera G, Sinnott R (2019) A performance comparison of cloud-based container orchestration tools. In: 2019 IEEE International Conference on Big Knowledge (ICBK), IEEE, pp 191–198
Naser H (2017) Kubernetes Vs. mesos: a comparison of containerization platforms part II https://vexxhost.com/blog/kubernetes-mesos-comparison-containerization/
Modak A, Chaudhary S, Paygude P, Ldate S (2018) Techniques to secure data on cloud: docker swarm or kubernetes? In: 2018 Second International Conference on Inventive Communication and Computational Technologies (ICICCT), IEEE, pp 7–12
Nomad (2020) Nomad vs. Kubernetes https://www.nomadproject.io/intro/vs/kubernetes/
Linzel B, Zhu E, Flores G, Liu J, Dikaleh S (2019) How can OpenShift accelerate your Kubernetes adoption: a workshop exploring openShift features. In: Proceedings of the 29th Annual International Conference on Computer Science and Software Engineering, pp 380–381
Anderson C (2015) Docker [software engineering]. IEEE Software 32(3):102-c3
Martin JP, Kandasamy A, Chandrasekaran K (2018) Exploring the support for high performance applications in the container runtime environment. Human-centric Comput Inf Sci 8(1):1–15
Xie XL, Wang P, Wang Q (2017) The performance analysis of Docker and rkt based on Kubernetes. 2017 13th International Conference on Natural Computation. Fuzzy Systems and Knowledge Discovery (ICNC-FSKD), IEEE, pp 2137–2141
Arundel J, Domingus J (2019) Cloud native devops with kubernetes: building, deploying, and scaling modern applications in the cloud. O’Reilly Media
Saito H, Lee HCC, Wu CY (2019) DevOps with Kubernetes: accelerating software delivery with container orchestrators. Packt Publishing Ltd
Kubernetes\(\_\)Official\(\_\)Documentation (2021) Kubernetes Components https://kubernetes.io/docs/concepts/overview/components/
Mannambeth M (2020) Certified kubernetes administrator (CKA) with practice tests. https://www.udemy.com/course/certified-kubernetes-administrator-with-practice-tests/learn/lecture/14296142
Kumar R, Trivedi MC (2021) Networking analysis and performance comparison of kubernetes CNI Plugins. Advances in computer. Springer, Berline, pp 99–109
Boettiger C (2015) An introduction to Docker for reproducible research. ACM SIGOPS Oper Syst Rev 49(1):71–79
Belmont JM (2018) Hands-On continuous integration and delivery: build and release quality software at scale with Jenkins, Travis CI, and CircleCI. Packt Publishing Ltd
Sewak M, Singh S (2018) Winning in the era of serverless computing and function as a service. In: 2018 3rd International Conference for Convergence in Technology (I2CT), pp 1–5
Eivy A (2017) Be wary of the economics of“ Serverless’’ cloud computing. IEEE Cloud Comput 4(2):6–12
Van Eyk E, Toader L, Talluri S, Versluis L, Uţă A, Iosup A (2018) Serverless is more: from PaaS to present cloud computing. IEEE Internet Comput 22(5):8–17
Yan M, Castro P, Cheng P, Ishakian V (2016) Building a chatbot with serverless computing. In: Proceedings of the 1st International Workshop on Mashups of Things and APIs, pp 1–4
Spillner J (2017) Snafu: Function-as-a-service (faas) runtime design and implementation. arXiv preprint arXiv:170307562
Kuntsevich A, Nasirifard P, Jacobsen HA (2018) A distributed analysis and benchmarking framework for apache openwhisk serverless platform. In: Proceedings of the 19th International Middleware Conference (Posters), pp 3–4
Djemame K, Parker M, Datsev D (2020) Open-source serverless architectures: an Evaluation of Apache OpenWhisk. In: 2020 IEEE/ACM 13th International Conference on Utility and Cloud Computing (UCC), IEEE, pp 329–335
Ellis A (2019) The power of interfaces in OpenFaaS https://blog.alexellis.io/the-power-of-interfaces-openfaas/
Kaewkasi C (2018) Docker for serverless applications: containerize and orchestrate functions using OpenFaas, OpenWhisk, and Fn. Packt Publishing Ltd
Prometheus\(\_\)Official\(\_\)Documentation (2021) What is Prometheus? https://prometheus.io/docs/introduction/overview/
Sabharwal N, Pandey P (2020) Getting started with prometheus and alert manager. In: Monitoring Microservices and Containerized Applications, Springer, pp 43–83
Turnbull J (2018) Monitoring with Prometheus. Turnbull Press
Brazil B (2018) Prometheus: up & running: infrastructure and application performance monitoring. “ O’Reilly Media, Inc.”
Brattstrom M, Morreale P (2017) Scalable agentless cloud network monitoring. In: 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud), IEEE, pp 171–176
Nguyen N, Kim T (2020) Toward highly scalable load balancing in kubernetes clusters. IEEE Commun Mag 58(7):78–83
Trivedi KS, Sahner R (2009) SHARPE at the age of twenty two. ACM SIGMETRICS Perform Eval Rev 36(4):52–57
Ou X, Singhal A (2011) Quantitative security risk assessment of enterprise networks. Springer, Berlin
Henley EJ, Kumamoto H (1996) Probabilistic risk assessment and management for engineers and scientists. IEEE Press (2nd Edition)
Stallings W, Brown L, Bauer MD, Bhattacharjee AK (2012) Computer security: principles and practice. Pearson Education Upper Saddle River, NJ, USA
Hubbard DW, Seiersen R (2016) How to measure anything in cybersecurity risk. Wiley Online Library
Ingoldsby TR (2010) Attack tree-based threat risk analysis. Amenaza Technologies Limited pp 3–9
Coles-Kemp L, Bullée JW, Montoya L, Junger M, Heath C, Pieters W, Wolos L (2015) Technology-supported Risk Estimation by Predictive Assessment of Socio-technical Security
Alpernas K, Flanagan C, Fouladi S, Ryzhyk L, Sagiv M, Schmitz T, Winstein K (2018) Secure serverless computing using dynamic information flow control. arXiv preprint arXiv:180208984
Bacon J, Eyers D, Pasquier TFM, Singh J, Papagiannis I, Pietzuch P (2014) Information flow control for secure cloud computing. IEEE Transac Netw Service Manag 11(1):76–89
Alpernas K, Flanagan C, Fouladi S, Ryzhyk L, Sagiv M, Schmitz T, Winstein K (2018) Secure serverless computing using dynamic information flow control. Proc ACM Program Lang 2(OOPSLA), https://doi.org/10.1145/3276488
O’Meara W, Lennon RG (2020) Serverless computing security: protecting application logic. In: 2020 31st Irish Signals and Systems Conference (ISSC), IEEE, pp 1–5
Podjarny G (2019) Serverless Security. O’Reilly Media Inc
Li X, Leng X, Chen Y (2021) Securing serverless computing: challenges, solutions, and opportunities. arXiv preprint arXiv:210512581
Datta P, Kumar P, Morris T, Grace M, Rahmati A, Bates A (2020) Valve: securing function workflows on serverless computing platforms. Proc The Web Conf 2020:939–950
Kelly D, Glavin FG, Barrett E (2021) Denial of wallet-defining a looming threat to serverless computing. J Inform Security Appl 60:102843
Jonas E, Schleier-Smith J, Sreekanti V, Tsai CC, Khandelwal A, Pu Q, Shankar V, Carreira J, Krauth K, Yadwadkar N, et al. (2019) Cloud programming simplified: a berkeley view on serverless computing. arXiv preprint arXiv:190203383
Ruddle A, Ward D, Weyl B, Idrees S, Roudier Y, Friedewald M, Leimbach T, Fuchs A, Gürgens S, Henniger O, et al. (2009) Deliverable D2. 3: Security requirements for automotive on-board networks based on dark-side scenarios. EVITA project
Guo J, Rahimi M, Cleland-Huang J, Rasin A, Hayes JH, Vierhauser M (2016) Cold-start software analytics. In: Proceedings of the 13th International Conference on Mining Software Repositories, pp 142–153
Štefanič P, Cigale M, Jones AC, Knight L, Taylor I, Istrate C, Suciu G, Ulisses A, Stankovski V, Taherizadeh S et al (2019) SWITCH workbench: a novel approach for the development and deployment of time-critical microservice-based cloud-native applications. Future Gener Comput Syst 99:197–212
Ghosh BC, Addya SK, Somy NB, Nath SB, Chakraborty S, Ghosh SK (2020) Caching techniques to improve latency in serverless architectures. In: 2020 International Conference on COMmunication Systems & NETworkS (COMSNETS), IEEE, pp 666–669
Hall A, Ramachandran U (2019) An execution model for serverless functions at the edge. In: Proceedings of the International Conference on Internet of Things Design and Implementation, pp 225–236
Nguyen HD, Zhang C, Xiao Z, Chien AA (2019) Real-time serverless: enabling application performance guarantees. In: Proceedings of the 5th International Workshop on Serverless Computing, pp 1–6
Du D, Yu T, Xia Y, Zang B, Yan G, Qin C, Wu Q, Chen H (2020) Catalyzer: sub-millisecond startup for serverless computing with initialization-less booting. In: Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems, pp 467–481
Bermbach D, Karakaya AS, Buchholz S (2020) Using application knowledge to reduce cold starts in FaaS services. In: Proceedings of the 35th Annual ACM Symposium on Applied Computing, pp 134–143
Mahajan K, Mahajan S, Misra V, Rubenstein D (2019) Exploiting content similarity to address cold start in container deployments. In: Proceedings of the 15th International Conference on emerging Networking EXperiments and Technologies, pp 37–39
Bardsley D, Ryan L, Howard J (2018) Serverless performance and optimization strategies. In: 2018 IEEE International Conference on Smart Cloud (SmartCloud), IEEE, pp 19–26
Mahmoudi N, Lin C, Khazaei H, Litoiu M (2019) Optimizing serverless computing: introducing an adaptive function placement algorithm. In: Proceedings of the 29th Annual International Conference on Computer Science and Software Engineering, pp 203–213
Aske A, Zhao X (2018) Supporting multi-provider serverless computing on the edge. In: Proceedings of the 47th International Conference on Parallel Processing Companion, pp 1–6
Correia J, Ribeiro F, Filipe R, Arauio F, Cardoso J (2018) Response time characterization of microservice-based systems. In: 2018 IEEE 17th International Symposium on Network Computing and Applications (NCA), IEEE, pp 1–5
Tsai PH, Hong HJ, Cheng AC, Hsu CH (2017) Distributed analytics in fog computing platforms using tensorflow and kubernetes. In: 2017 19th Asia-Pacific Network Operations and Management Symposium (APNOMS), IEEE, pp 145–150
Zhou J, Velichkevich A, Prosvirov K, Garg A, Oshima Y, Dutta D (2019) Katib: A distributed general automl platform on kubernetes. In: 2019 \(\{\)USENIX\(\}\) Conference on Operational Machine Learning (OpML 19), pp 55–57
Trakadas P, Nomikos N, Michailidis ET, Zahariadis T, Facca FM, Breitgand D, Rizou S, Masip X, Gkonis P (2019) Hybrid clouds for data-intensive, 5G-enabled IoT applications: an overview, key issues and relevant architecture. Sensors 19(16):3591
Alonso-Monsalve S, García-Carballeira F, Calderón A (2018) A heterogeneous mobile cloud computing model for hybrid clouds. Future Gener Comput Syst 87:651–666
Barcelona-Pons D, García-López P, Ruiz Á, Gómez-Gómez A, París G, Sánchez-Artigas M (2019) Faas orchestration of parallel workloads. In: Proceedings of the 5th International Workshop on Serverless Computing, pp 25–30
Ramon-Cortes C, Serven A, Ejarque J, Lezzi D, Badia RM (2018) Transparent orchestration of task-based parallel applications in containers platforms. J Grid Comput 16(1):137–160
Author information
Authors and Affiliations
Corresponding author
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
About this article
Cite this article
Mondal, S.K., Pan, R., Kabir, H.M.D. et al. Kubernetes in IT administration and serverless computing: An empirical study and research challenges. J Supercomput 78, 2937–2987 (2022). https://doi.org/10.1007/s11227-021-03982-3
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s11227-021-03982-3