Patent ID: 11947660
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 10:
11. A computer system for securing pods in a container orchestration environment, the computer system comprising:
a bus system;
a storage device connected to the bus system, wherein the storage device stores program instructions; and
a processor connected to the bus system, wherein the processor executes the program instructions to:
verify, using an agent embedded in a trusted execution environment of the computer system, a container runtime interface command to perform an orchestration action on a set of containers comprising an application workload that corresponds to a service hosted by the container orchestration environment based on matching the container runtime interface command to a rule contained in a trusted execution environment contract included in a pod sandbox virtual machine of the trusted execution environment;
verify, using the agent, a digital signature of the trusted execution environment contract included in the pod sandbox virtual machine with the set of containers that corresponds to the service deployed in the trusted execution environment based on a contract verification key corresponding to an application owner providing the service in the container orchestration environment;
determine, using the agent, whether the container runtime interface command to perform the orchestration action on the set of containers is valid based finding a matching rule in the trusted execution environment contract; and
execute, using the agent, the container runtime interface command to perform the orchestration action on the set of containers comprising the application workload that corresponds to the service in the pod sandbox virtual machine of the trusted execution environment in response to determining, using the agent, that the container runtime interface command to perform the orchestration action on the set of containers is valid based on finding the matching rule in the trusted execution environment contract.