DEVELOPMENT OF AN ACCESS CONTROLLER MODEL FOR KUBERNETES SECURITY WITH PROVABLE PAC GUARANTEES BASED ON ENTROPY

Abstract

The article proposes a mathematical model of an RL-Admit Admission Controller to ensure security in Kubernetes container orchestration environments. Unlike traditional solutions such as OPA Gatekeeper and Kyverno, which rely on static declarative policies, the proposed approach combines reinforcement learning, information-entropic analysis of requests, and PAC learning (Probably Approximately Correct) theory. The task of validating requests to the API server is formalized as a Partially Observable Markov Decision Process (POMDP), whose optimal admission/rejection policy is learned using the Proximal Policy Optimization (PPO) algorithm. The anomalousness of each request is quantitatively assessed through Shannon entropy relative to a reference distribution of safe configurations, while applying the PAC framework enables mathematically proven bounds on classification error probabilities ε and δ. This eliminates a key drawback of existing intelligent protection systems – the lack of reliability guarantees – which is unacceptable for critical infrastructure. Experimental studies on test clusters confirmed the model's ability to detect complex attack vectors (privileged containers, unauthorized RBAC changes, runc escape, supply chain attacks). The full RL-Admit model with PAC guarantees and entropy achieves a true positive rate (TPR) of up to 96-97% at a false positive rate (FPR) of 0.6% after 50,000 requests and detects all 8 zero-day attack types, whereas static policies block only a few of them. Meanwhile, the system responds to attacks in an average of 1 minute compared to 38-45 minutes for static policies, adding only a negligible request processing delay of approximately 24 ms. The results have practical significance for building Zero Trust adaptive protection systems in dynamic cloud environments and integrating them into DevSecOps processes.