Kubernetes application deployment security detection and repair method and system based on RAG mechanism

Abstract

The invention provides a Kubernetes application deployment security detection and repair method and system based on an RAG mechanism, and the method comprises the steps: S1, obtaining a resource list file of Kubernetes, and obtaining structured configuration data through grammar analysis; s2, key security fields of the structured configuration data are extracted and subjected to semantic characterization processing; and S3, constructing a security knowledge index database based on the key security field, performing real-time dynamic retrieval and obtaining a corresponding retrieval knowledge result, and further enabling the large language statement model to generate a corresponding repair scheme report and deploy repair configuration according to the retrieval knowledge result and the structured configuration data. According to the method, external knowledge dynamic retrieval is realized based on retrieval enhancement, repeated training of the model is avoided, and real-time, semantic and interpretable automatic detection and repair are provided.

Description

Technical Field

[0001] This invention belongs to the field of cloud-native security technology, specifically relating to a method and system for security detection and remediation of Kubernetes application deployments based on the RAG mechanism. More specifically, this invention belongs to intelligent security detection and configuration remediation technology, and is a method for security detection and remediation of Kubernetes application deployments based on a retrieval-enhanced generation mechanism. Background Technology

[0002] Kubernetes is currently the most widely used container orchestration platform, which defines the runtime configuration of applications through a resource manifest file, i.e., YAML format.

[0003] Due to the complexity, deep hierarchy, and numerous fields of configuration items, developers are prone to making security configuration errors, such as excessive container privileges, leakage of sensitive information, network exposure, or misuse of mount paths. These misconfigurations often lead to serious security risks such as container escape and loss of cluster control.

[0004] Currently, existing detection tools such as Kubescape and Checkov rely on static rule template matching, making it difficult to detect semantic-level risks and lacking automatic remediation capabilities. While traditional artificial intelligence solutions can improve model specialization, they require continuous training, resulting in high maintenance costs, delayed updates, and an inability to utilize the latest vulnerability knowledge in real time.

[0005] Retrieval-enhanced generation (RAG) technology introduces external knowledge retrieval mechanisms, enabling large language models to dynamically call upon external knowledge bases during generation. RAG performs exceptionally well in question answering, document understanding, and security analysis, achieving continuous knowledge updates without retraining the model.

[0006] Therefore, the RAG mechanism is introduced into Kubernetes configuration security inspection to overcome the technical problems of continuous training, high maintenance costs, delayed updates, and inability to utilize the latest vulnerability knowledge in real time. Summary of the Invention

[0007] In view of the deficiencies in the existing technology, the purpose of this invention is to provide a method and system for security detection and repair of Kubernetes application deployment based on the RAG mechanism.

[0008] A Kubernetes application deployment security detection and remediation method based on the RAG mechanism provided by the present invention includes: Step S1: Obtain the Kubernetes resource manifest file and parse it to obtain structured configuration data; Step S2: Extract and semantically characterize the key security fields of the structured configuration data; Step S3: Construct a security knowledge index library based on key security fields, perform real-time dynamic retrieval and obtain corresponding retrieval knowledge results, and then enable the big data language model to generate a corresponding remediation plan report based on the retrieval knowledge results and the structured configuration data, and deploy the remediation configuration.

[0009] Preferably, in step S1, the resource manifest file is a Kubernetes resource file defined in YAML format, including: Deployment, Pod, Service, ConfigMap, Role, and RoleBinding.

[0010] Preferably, in step S2, the text content of the structured configuration data is converted into a vector representation through semantic feature processing to obtain the key security fields; The key security fields include: securityContext, privileged, and networkPolicy; In step S3, the security knowledge index includes: CIS Kubernetes Benchmark, security hardening guidelines, CVE vulnerability descriptions, remediation suggestions, and Kubernetes community practice solutions.

[0011] Preferably, the process further includes step S4: applying the repair configuration obtained in step S3 in an isolated Kubernetes sandbox environment, monitoring the Pod's lifecycle, Liveness, and Readiness, and determining whether the repair solution is available. If the result is yes, the current repair process ends; if the result is no, the error log information generated during the deployment or operation of the repair configuration is collected, and the error log is used as negative feedback data, along with the original configuration data, to re-execute step S3 to generate a new repair solution, until a repair configuration that can be verified is generated.

[0012] Preferably, the update mechanism of the security knowledge index includes adversarial sample generation, that is, optimizing the qualified configurations in the security knowledge index; the optimization operation includes data perturbation and deletion of key security fields.

[0013] According to the present invention, a Kubernetes application deployment security detection and repair system based on the RAG mechanism includes: module M1: obtaining the Kubernetes resource manifest file and obtaining structured configuration data through syntax parsing; Module M2: Extracts and semantically characterizes key security fields from structured configuration data; Module M3: Constructs a security knowledge index based on key security fields, performs real-time dynamic retrieval and obtains corresponding retrieval knowledge results, and then enables the big data language model to generate corresponding remediation plan reports and deploy remediation configurations based on the retrieval knowledge results and the structured configuration data.

[0014] Preferably, in module M1, the resource manifest file is a Kubernetes resource file defined in YAML format, including: Deployment, Pod, Service, ConfigMap, Role, and RoleBinding.

[0015] Preferably, in module M2, the text content of structured configuration data is converted into a vector representation through semantic feature processing, thereby obtaining key security fields; The key security fields include: securityContext, privileged, and networkPolicy; In module M3, the security knowledge index includes: CIS Kubernetes Benchmark, security hardening guide, CVE vulnerability descriptions, remediation suggestions, and Kubernetes community practice solutions.

[0016] Preferably, it also includes module M4: applying the repair configuration obtained by module M3 in an isolated Kubernetes sandbox environment, monitoring the Pod's lifecycle, Liveness, and Readiness, and determining whether the repair solution is available. If the result is yes, the current repair process ends; if the result is no, it collects error log information generated during the deployment or operation of the repair configuration, and uses the error log as negative feedback data, together with the original configuration data, to re-trigger module M3 to generate a new repair solution, until a repair configuration that can be verified is generated.

[0017] 10. The Kubernetes application deployment security detection and remediation system based on the RAG mechanism according to claim 6, wherein the update mechanism of the security knowledge index includes adversarial sample generation, that is, optimizing the qualified configurations in the security knowledge index; the optimization operation includes data perturbation and deletion of key security fields.

[0018] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention achieves dynamic retrieval of external knowledge through retrieval enhancement, avoids repeated model training, and provides real-time, semantic, and interpretable automatic detection and repair.

[0019] 2. The knowledge base used for retrieval in this invention can be updated at any time, supporting the immediate detection of new vulnerabilities; and the accuracy of this invention is high, as it combines semantic understanding with external knowledge reasoning, significantly improving detection accuracy.

[0020] 3. Each detection result output of this invention includes a knowledge source, enhancing credibility and providing corresponding remediation suggestions. This invention continuously optimizes detection capabilities through a dynamic knowledge base update mechanism, enabling semantic-level risk identification and automated remediation of Kubernetes configurations, balancing detection accuracy and knowledge timeliness. Attached Figure Description

[0021] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 A flowchart of the steps provided for this invention; Figure 2 The structural diagram of the system provided by the present invention. Detailed Implementation

[0022] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0023] This invention provides a Kubernetes application deployment security detection and remediation method based on the RAG mechanism, comprising: resource inventory collection and parsing, obtaining YAML format resource files and converting them into structured data; extracting key security fields and performing semantic feature processing; dynamically retrieving relevant security rules, vulnerabilities, and remediation knowledge from the security knowledge base through the RAG mechanism; performing semantic reasoning by combining configuration data and retrieval knowledge using a large language model to identify risk items and levels; generating a remediation suggestion template consistent with the original configuration structure and attaching supporting evidence; outputting a detection report, supporting automated verification and deployment; and continuously optimizing detection capabilities through a dynamic knowledge base update mechanism.

[0024] This invention provides a method and system for security detection and automatic remediation of Kubernetes application deployment configurations based on knowledge retrieval enhancement. This method organically combines a rule engine, RAG inference, and a Large Language Model (LLM) to achieve automated security processing of Kubernetes configuration files at the semantic level and through dynamic verification. In other words, the purpose of this invention is to propose a method for security detection and remediation of Kubernetes application deployments that combines a Large Language Model and a RAG mechanism. Through knowledge retrieval enhancement and context generation, it achieves semantic-level security detection and automated remediation suggestion generation for configuration files, including: Risk identification and remediation suggestion generation steps: The large language model combines user input and retrieved knowledge context to perform reasoning, generate potential risk analysis results, and output configuration problem description, risk level and basis source; at the same time, the model generates remediation suggestion templates based on risk results and knowledge content, maintaining the consistency of the original file structure.

[0025] Report output and verification steps: The system outputs a detection report containing risk type, configuration path, risk level, knowledge source and remediation suggestions; the remediated configuration is automatically deployed in the isolated environment and business availability is verified.

[0026] Knowledge base dynamic update steps: The system regularly updates the knowledge index from the CVE database, CNCF announcements and Kubernetes official documentation to achieve dynamic knowledge expansion.

[0027] Specifically, the semantic feature processing converts the text content of key security configuration items into vector representations and calculates semantic similarity to retrieve corresponding security knowledge fragments.

[0028] Specifically, the security knowledge base includes CIS Kubernetes Benchmark baseline rules, CVE vulnerability database information, cloud-native security hardening guidelines, community best practice documents, and remediation example templates.

[0029] Specifically, the large language model combines the input configuration with the external retrieved knowledge context to perform reasoning, and outputs detection results that include risk item descriptions, risk levels, confidence scores, and knowledge source descriptions.

[0030] Specifically, the repair suggestion template is generated by the large language model based on the inference results. The output YAML file maintains the same structure as the original configuration and adds the reason and basis for each repair item.

[0031] Specifically, the method includes a knowledge retrieval module and a generation module. The knowledge retrieval module performs similarity retrieval of security knowledge based on a vector database, and the generation module is used to perform reasoning analysis and generate repair suggestions by combining the retrieval results with the input configuration.

[0032] Specifically, the vector database uses FAISS or Milvus to build a knowledge index, and achieves efficient knowledge retrieval and context fusion through cosine similarity calculation.

[0033] Specifically, the method is integrated into the CI / CD continuous integration process as a container plugin, automatically executing security checks and remediation recommendations during the application deployment phase.

[0034] Specifically, the dynamic update mechanism of the knowledge base updates the security knowledge index in real time by periodically synchronizing the CVE database, CNCF announcements and Kubernetes official security announcements, thereby enabling the self-evolution and continuous optimization of the detection system.

[0035] Example 1: This example provides a Kubernetes application deployment security detection and remediation method based on the RAG mechanism, including: Resource inventory collection and parsing steps: Obtain the resource inventory file of the application in the Kubernetes cluster, perform syntax parsing and field extraction to form structured configuration data; for the Helm Chart package, first perform template rendering to convert it into a specific resource inventory file, and then parse it.

[0036] Semantic feature extraction and knowledge retrieval steps: Extract key security-related fields from the resource list and convert them into a text input format that the model can understand; establish a security knowledge index based on a vector database. When the model receives configuration input, the retrieval module calculates its semantic vector representation and retrieves the security knowledge paragraphs most relevant to the configuration, forming an external knowledge context.

[0037] In other words, the Kubernetes application deployment security detection and remediation method based on the RAG mechanism provided by the present invention includes: Resource Inventory Collection and Parsing: Obtain the resource inventory files of applications in the Kubernetes cluster, perform syntax parsing and field extraction to form structured configuration data.

[0038] In other words, it obtains the resource manifest file of the Kubernetes cluster and performs syntax parsing to form structured configuration data.

[0039] The resource manifest file includes Kubernetes resource files defined in YAML format, such as Deployment, Pod, Service, ConfigMap, Role, and RoleBinding.

[0040] Semantic feature extraction: Extract key security-related fields from the configuration file and perform semantic feature processing, that is, convert them into a text input format that the model can understand.

[0041] The key security-related fields include: securityContext, privileged, and networkPolicy.

[0042] Specifically, the semantic feature extraction process includes: first, executing a template rendering command on the Helm Chart package to convert it into a specific Kubernetes resource manifest file, and then performing slicing and key field extraction to solve the semantic fragmentation problem caused by cross-file variable dependencies. The template rendering command includes helm template.

[0043] Knowledge retrieval module: Establish a security knowledge index based on a vector database.

[0044] Specifically, the vector database is used to store security knowledge data after vectorization, which achieves efficient retrieval based on semantic similarity by mapping textual security knowledge to a vector space.

[0045] When building a security knowledge index, the system first preprocesses the security knowledge data, including text cleaning, semantic slicing, and filtering of irrelevant content. Then, it uses an embedding model to convert the processed knowledge fragments into vector representations. Finally, it stores the vectors and their corresponding original knowledge content in a vector database and builds a similarity index to support subsequent semantic retrieval operations.

[0046] The knowledge base includes CIS Kubernetes Benchmark, security hardening guidelines, CVE vulnerability descriptions, remediation suggestions, and Kubernetes community best practices.

[0047] Specifically, the extraction of security knowledge is accomplished through an automated process. The system obtains raw text data from security baseline documents, vulnerability announcements, and open-source project remediation records, and then classifies the text data using a combination of rule filtering and semantic analysis.

[0048] Descriptions directly related to the causes, scope of impact, and remediation methods of security defects are identified as remediation knowledge text; information containing specific configuration changes or code differences is identified as remediation examples; and background or explanatory content unrelated to security detection and remediation is automatically removed, thereby ensuring that the content included in the security knowledge index is highly relevant to the risk identification and remediation generation process.

[0049] When the model receives configuration input, the retrieval module calculates its semantic vector representation and retrieves the security knowledge paragraphs most relevant to the configuration to form an external knowledge context.

[0050] In other words, based on the retrieval-enhanced generation mechanism, security rules, vulnerability descriptions and remediation knowledge related to the configuration content are dynamically retrieved from the security knowledge base, and the retrieved knowledge context and configuration data are input into the large language model for risk identification and semantic reasoning. Automatically generate a repair suggestion template consistent with the original configuration structure based on the reasoning results, along with an explanation of the repair basis; It outputs detection reports and repair templates for user review or automatic application; and achieves real-time expansion of security knowledge and continuous enhancement of model reasoning capabilities through a dynamic knowledge base update mechanism.

[0051] Specifically, the knowledge retrieval module establishes an index in the vector database. In addition to baseline standards and vulnerability intelligence, the data source of the knowledge base also includes YAML configuration files extracted from high-star open-source projects, corresponding Issue and fix commit records, as practical reference examples for model generation code.

[0052] Risk identification module: The large language model combines user input with retrieved knowledge context to reason and generate potential risk analysis results, outputting configuration problem descriptions, risk levels and sources of evidence.

[0053] Specifically, the risk identification is based on a preset multi-level security configuration defect classification system, which includes several primary categories and corresponding secondary subcategories, covering dimensions such as privilege escalation, resource abuse, network exposure, and sensitive information leakage. Specifically, when identifying risks, the model combines the retrieved knowledge context to analyze the possible attack paths that the configuration may lead to. For example, it uses the MITRE ATT&CK for Containers framework to determine whether there is a potential container escape risk, i.e., the T1611 risk.

[0054] Repair suggestion generation: The model generates repair suggestion templates based on risk results and knowledge content, maintaining the same structure as the original file, and includes comments explaining the reasons for the repair and the sources of the referenced knowledge.

[0055] Specifically, when generating remediation suggestions, the model employs Prompt Engineering to guide the model to output structured JSON format results, which include the defect file path, line number, risk level, and specific remediation code snippets.

[0056] The system outputs and verifies reports, including a detection report that specifies the risk type, configuration path, risk level, knowledge source, and remediation recommendations. Automated remediation deployment and verification are supported.

[0057] Specifically, the report output and verification steps support automated repair deployment and verification. Specifically, in an isolated Kubernetes sandbox environment, the application's repaired configuration is used to verify the business availability of the repair solution by monitoring the lifecycle status of Pods and the Liveness and Readiness Probe status. Specifically, when the verification step fails, such as when the application crashes, it can automatically capture error logs, use them as negative feedback, trigger the large language model to perform secondary correction, and form a repair closed loop.

[0058] The knowledge base has a dynamic update mechanism. Specifically, the system regularly updates the knowledge index from the CVE database, CNCF announcements, and Kubernetes official documentation to achieve dynamic knowledge expansion under zero-fine-tuning conditions. Specifically, the knowledge base dynamic update mechanism also includes adversarial sample generation: by perturbing parameters of compliant configurations, deleting key security fields, or injecting functionally equivalent but non-standard code, adversarial samples are generated and stored in the knowledge base to enhance the model's ability to identify malicious obfuscated configurations.

[0059] Example 2: This example also provides a Kubernetes application deployment security detection and repair system based on a retrieval enhancement generation mechanism, including the following modules: Data Acquisition and Parsing Module: Used to obtain resource manifest files from Kubernetes clusters or code repositories, and perform syntax parsing, Helm template rendering, and key field extraction.

[0060] Knowledge retrieval module: Built on a vector database, it stores vectorized security baselines, vulnerability intelligence, and best practices, and is responsible for retrieving relevant external knowledge context based on the semantic features of the input.

[0061] Large Language Model Inference Module: Integrates a retrieval enhancement generation mechanism, namely the RAG mechanism, which combines the configuration to be tested with the retrieved knowledge context to perform deep semantic reasoning, identify logical vulnerabilities, and generate repair code.

[0062] Automated Verification and Reporting Module: Responsible for deploying the remediated configuration in the sandbox environment, monitoring the application status, and generating a final report containing detailed remediation recommendations and risk assessment.

[0063] Example 3: Those skilled in the art can understand this example as a more specific description of Example 1 and Example 2.

[0064] This embodiment provides a Kubernetes application deployment security detection and remediation method based on the RAG mechanism. This method solves the problems of traditional static detection tools being unable to understand semantics, the lag in knowledge of large language models, and the tendency to generate illusions through the RAG mechanism.

[0065] Regarding the resource inventory collection and parsing steps: Specifically, the system supports multiple input sources (such as Git repositories and cluster runtime configurations) and performs standardized processing on the acquired YAML files. For Helm Charts, the system calls the helmtemplate command to process values.yaml and template files, generating the final effective Kubernetes manifest, thereby resolving the semantic fragmentation problem caused by cross-file variable references.

[0066] Steps for semantic feature extraction and knowledge retrieval.

[0067] Specifically, the system uses the Embedding model to transform the extracted key fields such as securityContext and RBAC into high-dimensional vectors.

[0068] The semantic feature extraction uses configuration fields as the basic granularity and combines them with the context information of the fields for processing. For configuration files that are long, i.e., longer than a preset threshold, the system uses a combination of context slicing and sliding windows to extract continuous configuration fragments, in order to avoid semantic incompleteness caused by missing context, thereby improving the accuracy and stability of vector retrieval.

[0069] The knowledge base pre-stores sliced ​​and vectorized CIS Kubernetes Benchmark, NVD CVE database, and historical fixes and commits from high-star open-source projects.

[0070] During retrieval, a cosine similarity algorithm is used to recall the Top-K most relevant knowledge fragments. For example, the description of "CVE-2022-xxxx container escape vulnerability" and its corresponding remediation configuration examples are retrieved. The embedding model includes OpenAI Embeddings or the HuggingFace open-source model.

[0071] Steps for generating risk identification and remediation recommendations.

[0072] Specifically, the system builds an enhanced Prompt that includes "role settings + code to be tested + knowledge retrieval + task instructions". Guided by the Prompt, the large language model not only identifies explicit configuration errors, such as "privileged: true", but also identifies hidden logical vulnerabilities through reasoning, such as potential privilege escalation caused by excessive ServiceAccount privileges. The model outputs remediation suggestions as standard YAML patch code with accompanying comments, such as "# Remediation basis: Refer to CIS 5.2.1, disable privileged mode to prevent host-level penetration". The large language model includes GPT-5 or CodeLlama.

[0073] Regarding report output and verification steps: Specifically, the verification process takes place in an isolated Kubernetes namespace. The system automatically applies the patched YAML, deploys it via `kubectl apply`, and continuously polls for Pod status and Liveness / Readiness Probe results.

[0074] Specifically, if the verification results show that the repair configuration can be deployed normally and pass the business availability verification, the current repair process ends and the successful verification result is output. When the verification result is a failure, the system automatically collects the error log information generated during the deployment failure process and adds the error log as negative feedback to the input of the new round of large language model. Together with the original configuration data and the retrieved security knowledge, it forms the updated prompt word input to guide the model to generate a repair scheme that avoids the verified failed configuration method, thereby forming a closed-loop mechanism of detection, repair, verification and correction.

[0075] The Pod status includes: Pending, Running, or CrashLoopBackOff.

[0076] Example 4: Those skilled in the art can understand this example as a more specific description of Example 1 and Example 2.

[0077] This embodiment proposes a Kubernetes application deployment security detection and remediation method based on the RAG mechanism. The method first establishes a dynamically updated vector knowledge base to ensure the timeliness of the detection basis; second, it utilizes RAG technology to "attach" a large model to the knowledge base, achieving accurate semantic analysis; finally, it ensures the usability of remediation suggestions through an automated verification closed loop.

[0078] In the semantic feature extraction step, the system performs context slicing on the configuration file, especially for long text configurations, and uses a sliding window mechanism to extract features to ensure the accuracy of vector retrieval.

[0079] In the aforementioned knowledge base dynamic update mechanism, the system is configured with a scheduled task to automatically crawl the latest CNCF security bulletins and NVD data every week. After cleaning and vectorization, the data is updated to the vector database index, thereby identifying the latest misconfigurations that may lead to vulnerability exploitation.

[0080] In the risk identification step, the model outputs based on a preset multi-level security configuration defect classification system. This system includes several primary categories and corresponding secondary subcategories, covering key security dimensions such as privilege escalation, resource abuse, network exposure, sensitive information leakage, and RBAC configuration defects.

[0081] In the step of generating repair suggestions, Prompt Engineering is used to optimize the output, forcing the model to return results in a structured JSON format, including: file_path, line_number, severity, fix_yaml, and reference.

[0082] Specifically, the risk level field is preferably generated by the system through mapping based on the risk level metadata pre-annotated in the retrieved security knowledge fragments; when the security knowledge does not explicitly annotate the risk level, a large language model can be used to assist in the determination based on the reasoning results.

[0083] The present invention also provides a Kubernetes application deployment security detection and repair system based on the RAG mechanism. The Kubernetes application deployment security detection and repair system based on the RAG mechanism can be implemented by executing the process steps of the Kubernetes application deployment security detection and repair method based on the RAG mechanism. That is, those skilled in the art can understand the Kubernetes application deployment security detection and repair method based on the RAG mechanism as a preferred embodiment of the Kubernetes application deployment security detection and repair system based on the RAG mechanism.

[0084] According to the present invention, a Kubernetes application deployment security detection and repair system based on the RAG mechanism includes: module M1: obtaining the Kubernetes resource manifest file and obtaining structured configuration data through syntax parsing; Module M2: Extracts and semantically characterizes key security fields from structured configuration data; Module M3: Constructs a security knowledge index based on key security fields, performs real-time dynamic retrieval and obtains corresponding retrieval knowledge results, and then enables the big data language model to generate corresponding remediation plan reports and deploy remediation configurations based on the retrieval knowledge results and the structured configuration data; Module M4: In an isolated Kubernetes sandbox environment, it applies the repair configuration obtained by Module M3, monitors the Pod's lifecycle, Liveness, and Readiness, and determines whether the repair solution is available. If the result is yes, no action is taken; if the result is no, error logs are captured as negative feedback, Module M3 is retried, and the negative feedback is added again until the repair is completed.

[0085] Module M1 includes a data acquisition and parsing module; Module M3 includes a knowledge retrieval module and a large language model reasoning module; and Module M4 includes an automated verification and reporting module.

[0086] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0087] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A Kubernetes application deployment security detection and remediation method based on the RAG mechanism, characterized in that, include: Step S1: Obtain the Kubernetes resource manifest file and parse it to obtain structured configuration data; Step S2: Extract and semantically characterize the key security fields of the structured configuration data; Step S3: Construct a security knowledge index library based on key security fields, perform real-time dynamic retrieval and obtain corresponding retrieval knowledge results, and then enable the big data language model to generate a corresponding remediation plan report based on the retrieval knowledge results and the structured configuration data, and deploy the remediation configuration.

2. The Kubernetes application deployment security detection and remediation method based on the RAG mechanism according to claim 1, characterized in that, In step S1, the resource manifest file is a Kubernetes resource file defined in YAML format, including: Deployment, Pod, Service, ConfigMap, Role, and RoleBinding.

3. The Kubernetes application deployment security detection and remediation method based on the RAG mechanism according to claim 1, characterized in that, In step S2, the text content of the structured configuration data is converted into a vector representation through semantic feature processing, thereby obtaining the key security fields; The key security fields include: securityContext, privileged, and networkPolicy; In step S3, the security knowledge index includes: CIS Kubernetes Benchmark, security hardening guidelines, CVE vulnerability descriptions, remediation suggestions, and Kubernetes community practice solutions.

4. The Kubernetes application deployment security detection and remediation method based on the RAG mechanism according to claim 1, characterized in that, It also includes step S4: Apply the repair configuration obtained in step S3 in the isolated Kubernetes sandbox environment, monitor the Pod's lifecycle, Liveness and Readiness, determine whether the repair solution is available, and if the result is yes, end the current repair process; If the result is negative, then collect the error log information generated during the deployment or operation of the repair configuration, and use the error log as negative feedback data, together with the original configuration data, to re-execute step S3 to generate a new repair scheme, until a repair configuration that can pass verification is generated.

5. The Kubernetes application deployment security detection and remediation method based on the RAG mechanism according to claim 1, characterized in that, The update mechanism of the security knowledge index includes adversarial sample generation, which optimizes the qualified configurations in the security knowledge index; the optimization includes data perturbation and deletion of key security fields.

6. A Kubernetes application deployment security detection and remediation system based on the RAG mechanism, characterized in that, Includes: Module M1: Obtains the Kubernetes resource manifest file and parses it to obtain structured configuration data; Module M2: Extracts and semantically characterizes key security fields from structured configuration data; Module M3: Constructs a security knowledge index based on key security fields, performs real-time dynamic retrieval and obtains corresponding retrieval knowledge results, and then enables the big data language model to generate corresponding remediation plan reports and deploy remediation configurations based on the retrieval knowledge results and the structured configuration data.

7. The Kubernetes application deployment security detection and remediation system based on the RAG mechanism according to claim 6, characterized in that, In module M1, the resource manifest file is a Kubernetes resource file defined in YAML format, including: Deployment, Pod, Service, ConfigMap, Role, and RoleBinding.

8. The Kubernetes application deployment security detection and remediation system based on the RAG mechanism according to claim 6, characterized in that, In module M2, the text content of structured configuration data is converted into a vector representation through semantic feature processing, thereby obtaining key security fields; The key security fields include: securityContext, privileged, and networkPolicy; In module M3, the security knowledge index includes: CIS Kubernetes Benchmark, security hardening guide, CVE vulnerability descriptions, remediation suggestions, and Kubernetes community practice solutions.

9. The Kubernetes application deployment security detection and remediation system based on the RAG mechanism according to claim 6, characterized in that, It also includes module M4: applying the repair configuration obtained by module M3 in an isolated Kubernetes sandbox environment, monitoring the Pod's lifecycle, Liveness, and Readiness, determining whether the repair solution is available, and ending the current repair process if the result is yes; If the result is negative, then the error log information generated during the deployment or operation of the repair configuration is collected, and the error log is used as negative feedback data, together with the original configuration data, to re-trigger the M3 module to generate a new repair scheme, until a repair configuration that can be verified is generated.

10. The Kubernetes application deployment security detection and remediation system based on the RAG mechanism according to claim 6, characterized in that, The update mechanism of the security knowledge index includes adversarial sample generation, which optimizes the qualified configurations in the security knowledge index; the optimization includes data perturbation and deletion of key security fields.

Images