# Quantum Key Distribution in Kubernetes Clusters
## 4 Integration in a Kubernetes Cluster
### Applications to Suitable Use Cases  
Multiple classical applications can enhance their security by leveraging QKD [27]. For example, in a multiuser smartphone network with a star-type architecture, a central session initiation protocol (SIP) server may share a key with each of its clients. In this case, QKD can supply these keys to symmetric cryptosystems such as the Advanced Encryption Standard (AES) that are adopted for encrypting the communication. Another interesting idea could be to use QKD systems based on free-space optics technologies to secure drone communications [28]. Additionally, QKD might be adopted in combination with other security protocols such as Internet Protocol Security (IPsec) and Transport Layer Security (TLS) to provide reliable key material. This approach can be implemented by adapting the latter protocols to use QKD keys through specific APIs. In various cases, it adopts particular variants or extensions of these protocols (e.g., TLS-PSK). From a modern network standpoint, there are a plethora of cloud-native applications that could either directly or indirectly benefit from our solution. Indeed, security applications running on a cluster, such as VPN endpoints, may directly require QKD keys from  
Figure 7: Key request process. SAE admin/operator creates a resource of type KeyRequest (1). QSS operator monitors resource creation (2). When it finds the new KeyRequest it starts the authentication through Keycloak (3) and forward the request to the QKS (4). At the end of the process it retrieves the QKD secret (5). the Kubernetes Operator and use them to configure a VPN tunnel among two endpoints. Furthermore, some applications may adopt special microservices called _service mesh_ (e.g., Istio [29] and delegate them security aspects such as the management of TLS connections. These objects can act as proxies and serve the upstream application, unaware of the TLS connection. Clearly, these microservices could also benefit from our solution to improve the TLS protocol security by using QKD. Starting from this wide range of possible applications, a timely and engaging example are the blockchain technologies. Today, blockchains serve different scenarios ranging from cryptocurrencies to supply chain management. Due to the sensitive data stored in a blockchain and the quantum threat affecting its technologies, it is reasonable to focus on building quantum-resistant blockchain networks. Several studies analyse the security of blockchain technologies, the impact of the quantum advent, and possible mitigation both coming from Post-Quantum and Quantum Cryptography [30; 31; 32]. Similar to the previous scenarios, QKD can enhance the security of blockchain technologies. A more practical example could be given by the Hyperledger project [33] and, in particular, by the Hyperledger Fabric framework. The nodes within this permissioned blockchain network extensively use the TLS protocol with algorithms such as RSA and ECDSA to communicate with each other. The role of QKD, in this case, is to build a quantum-resistant communication protocol between nodes and components of the framework, either based on an enhanced version of TLS or a new protocol. Regardless of the specific adoption as the final protocol, our solution could provide a consistent mechanism to integrate the QKD in such a scenario. The Hyperledger Fabric framework can be easily deployed as nodes within multiple Kubernetes clusters, thus requiring no changes to our current model. Finally, it is also worth mentioning that the QSS Operator has been designed to be flexible and to adapt to multiple contexts and scenarios. In particular, the QSS operators may serve as a central entity in a large cluster composed of hundreds or thousands of nodes as well as it could fit in scenarios with fixed resources such as in edge computing and IoT systems. Moreover, a tool such as K3s [34] can deploy an optimised Kubernetes cluster on a single node with limited resources.