Patent ID: 11947660
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. A computer-implemented method for securing pods in a container orchestration environment, the computer-implemented method comprising:
verifying, by a computer, using an agent embedded in a trusted execution environment of the computer, a container runtime interface command to perform an orchestration action on a set of containers comprising an application workload that corresponds to a service hosted by the container orchestration environment based on matching the container runtime interface command to a rule contained in a trusted execution environment contract included in a pod sandbox virtual machine of the trusted execution environment;
verifying, by the computer, using the agent, a digital signature of the trusted execution environment contract included in the pod sandbox virtual machine with the set of containers that corresponds to the service deployed in the trusted execution environment based on a contract verification key corresponding to an application owner providing the service in the container orchestration environment;
determining, by the computer, using the agent, whether the container runtime interface command to perform the orchestration action on the set of containers is valid based finding a matching rule in the trusted execution environment contract; and
responsive to the computer determining, using the agent, that the container runtime interface command to perform the orchestration action on the set of containers is valid based on finding the matching rule in the trusted execution environment contract, executing, by the computer, using the agent, the container runtime interface command to perform the orchestration action on the set of containers comprising the application workload that corresponds to the service in the pod sandbox virtual machine of the trusted execution environment.