Network isolation for cloud native applications in multitenant Architectures

This research examines the evolution of network isolation techniques with-in kubernetes-based containerized environment with an emphasis on early architectural patterns and their associated security constraints. It investigates the use of iptables and ebtables for packet filtering processes, as well the use of VXLAN based overlay networks for cross node communication. While these mechanisms are instrumental in supporting basic network segmentation, they were often complex to manage at scale, and had limited integration with identity aware security models. A comparison of key CNI plugins Calico, Flannel and Weave Net shows their weaknesses, strength and suitability in different deployment scenario. While there have been efforts with the introduction of Kubernetes Network Policies and early use of service mesh technologies, the first iteration of Kubernetes often suffered due to weak workload identity verification, inconsistent policy enforcement and limited traffic observation of east-west traffic. These weaknesses led to lateral movement within clusters as well as high risk in multi-tenant mode. The paper synthesizes these lessons to outline the practices that will yield stronger segmentation and Defense in depth in Container Ecosystems. It concludes with a future outlook of which the work to move towards identity driven, policy rich models of workload isolation pave the way for a more resilient cloud native security posture.