Abstract: In various examples there is a method performed by a controller in Kubernetes cluster. The method comprises: identifying a job to be completed by the cluster, from a plurality of jobs. In response to identifying a job to be completed by the cluster, determining at least one sidecar container associated with the job. In response to identifying a job to be completed by the cluster, determining that the job has been completed by querying a Kubernetes control plane of the cluster. In response to determining that the job has been completed, triggering termination of the sidecar container.

Abstract: Information is provided to a service mesh by a Kubernetes (K8s) controller. The information enables the service mesh to determine an IP address of application pods to which a monitoring request is destined. The K8s controller detects which of the application pods are scheduled to be monitored by the monitoring service. The K8s controller creates dummy headless services that match the application pods scheduled to be monitored. The service mesh is programmed information from the dummy headless services to cause the service mesh to intercept the monitoring request and identify that the monitoring request is destined to the dummy headless service based on the addresses. In response the service mesh encrypts the monitoring request.

Abstract: A computer-implemented method, data processing system and computer-readable medium for a pod of a container orchestration platform to secure metrics relating to the pod prior to transmission of metrics to a metrics collection service. The method comprising: receiving a secure request at a pod IP address and forwarding the request to a container of the pod; and receiving an insecure request at the pod IP address; examining the content of the received insecure request; from the examining, determining whether the received insecure request is requesting metrics information; if it was determined that the received insecure request does not request metrics information, passing the request to an original destination within the pod, and if it was determined that the received insecure request does request metrics information, rejecting the received insecure request.

Abstract: Using a service mesh in a cluster of a communications network to carry out mutual authentication between a session initiation protocol SIP compliant application in the cluster and a SIP device external to the cluster is described. The mutual authentication is accomplished using a certificate of the application that matches a naming system name used for the application. In response to the mutual authentication succeeding, a secure communication session is established between the application and the SIP device external to the cluster. The method comprises modifying SIP messages originating from the application to indicate that a secure communications protocol is in use. The modified SIP message are sent to the SIP device external to the cluster over the secure communication session.

Abstract: A method of processing traffic to provide a service is described. A first service mesh in a first cluster is used to ensure traffic is communicated within the first cluster using a secure communications protocol with mutual authentication accomplished using a certificate chain having a root certificate. A client in the first cluster originates traffic to a second cluster for processing, the second cluster having access to the root certificate. Using the first service mesh, routing the traffic to the second cluster is done using a secure communications protocol with mutual authentication. Mutual authentication is carried out between the first cluster and the second cluster using certificate chains having the root certificate; and in response to the mutual authentication being successful, application data is routed to the second cluster using the secure communications protocol such that the application data may be processed at the second cluster to provide the service.

Abstract: Techniques are disclosed for capturing diagnostics data in a distributed computing environment comprising a plurality of computing devices executing a plurality of Kubernetes pods. A worker node is configured with a staging area for storing temporary diagnostics data. An agent is configured to upload the temporary diagnostics data. Each container in the worker node is assigned a directory in the staging area for writing the container's temporary diagnostics data. When a container in the worker node has written a temporary diagnostics data file to the container's directory in the staging area, the temporary diagnostics data file is uploaded to the persistent storage.

Abstract: Techniques are disclosed for capturing diagnostics data in a distributed computing environment comprising a plurality of computing devices executing a plurality of Kubernetes pods. A worker node is configured with a staging area for storing temporary diagnostics data. An agent is configured to upload the temporary diagnostics data. Each container in the worker node is assigned a directory in the staging area for writing the container's temporary diagnostics data. When a container in the worker node has written a temporary diagnostics data file to the container's directory in the staging area, the temporary diagnostics data file is uploaded to the persistent storage.

Abstract: Example aspects include techniques for implementing a transparent TCP proxy for containerized applications. These techniques may include receiving an outgoing packet from the containerized application via a container bridge and determining, based on a connection associated with the outgoing packet, whether the outgoing packet corresponds to an incoming packet identified by a first marking as being redirected through the TCP proxy. In addition, the techniques may include in response to determining that the outgoing packet corresponds to the incoming packet, adding a second marking to the outgoing packet to indicate that the outgoing packet is to be routed through the TCP proxy, sending the outgoing packet to the TCP proxy based on the second marking, and transmitting an outgoing processed packet to an external device having the destination address, the outgoing processed packet resulting from a performance of a proxy operation by the TCP proxy on the outgoing packet.