🤖 AI Summary
This work addresses the challenge that large language models (LLMs) often generate Kubernetes security patches without awareness of runtime topological context, risking service dependency violations and functional disruptions. To overcome this limitation, the authors propose KuTIE, a novel framework that systematically integrates runtime topology information—including Istio call graphs, Trivy security findings, and service account bindings—into LLM prompt engineering to enable context-aware automated remediation. Experimental evaluation on the VulnCare platform demonstrates that incorporating such topological context substantially improves the correctness of dependency-sensitive patches, increasing accuracy from 11.1% to 78.0%. These results validate the effectiveness and innovation of the proposed approach in enhancing the precision of LLM-generated security configurations for Kubernetes environments.
📝 Abstract
Kubernetes is central to the cloud-native ecosystem, orchestrating containerised workloads. Recent work suggests that large language models (LLMs) can automate cluster security remediation, generating configuration patches from Kubernetes Security Posture Management (KSPM) findings without human authoring. Such systems, however, prompt the model with each finding in isolation from the live service call graph, assuming general hardening knowledge suffices. This assumption breaks down whenever a patch must preserve a runtime service dependency invisible to the model: an otherwise compliant fix then carries a destructive functional blast radius, crashing downstream callers or silently severing call edges across the cluster. Whether live cluster context improves patch correctness has not been measured under controlled conditions across multiple dependency classes. We introduce KuTIE (Kubernetes Topology Intelligence Engine), which builds a live cluster context from Istio call edges, Trivy KSPM findings, and the service-account bindings a workload reads, and conditions LLM patch generation on it. It is evaluated on VulnCare, a purpose-built 36-deployment, four-namespace healthcare cluster with 31 injectable findings across seven dependency classes, each labelled by topology dependence against cluster ground truth. Across 248 trials, topology context raises topology-dependent patch correctness from 11.1% to 78.0% ($Δ= 0.669$), a gap that holds for every model and for six of seven classes, from credential and network-policy ($Δ= 0.95$) to role-based access control ($Δ= 0.31$); a topology-independent control exhibits no such effect ($Δ= 0.0$), isolating the result from generic prompt enrichment. Supplying the live service-call graph and the service-account bindings it exposes thus improves remediation of topology-dependent findings well beyond scanner-only context.