Search papers, labs, and topics across Lattice.
This study evaluates the impact of incorporating runtime topology context into large language model (LLM)-generated security patches for Kubernetes, addressing the limitations of prior methods that relied solely on general hardening knowledge. By introducing KuTIE, which integrates live cluster context from Istio call edges and KSPM findings, the authors demonstrate a significant increase in patch correctness for topology-dependent vulnerabilities. The results show that topology context improves correctness rates from 11.1% to 78.0% across various dependency classes, highlighting the critical role of contextual awareness in automated security remediation.
Incorporating live service-call graphs into LLM-generated patches boosts correctness rates for Kubernetes security fixes from 11.1% to 78.0%, revealing a crucial oversight in current remediation approaches.
Kubernetes is central to the cloud-native ecosystem, orchestrating containerised workloads. Recent work suggests that large language models (LLMs) can automate cluster security remediation, generating configuration patches from Kubernetes Security Posture Management (KSPM) findings without human authoring. Such systems, however, prompt the model with each finding in isolation from the live service call graph, assuming general hardening knowledge suffices. This assumption breaks down whenever a patch must preserve a runtime service dependency invisible to the model: an otherwise compliant fix then carries a destructive functional blast radius, crashing downstream callers or silently severing call edges across the cluster. Whether live cluster context improves patch correctness has not been measured under controlled conditions across multiple dependency classes. We introduce KuTIE (Kubernetes Topology Intelligence Engine), which builds a live cluster context from Istio call edges, Trivy KSPM findings, and the service-account bindings a workload reads, and conditions LLM patch generation on it. It is evaluated on VulnCare, a purpose-built 36-deployment, four-namespace healthcare cluster with 31 injectable findings across seven dependency classes, each labelled by topology dependence against cluster ground truth. Across 248 trials, topology context raises topology-dependent patch correctness from 11.1% to 78.0% ($\Delta = 0.669$), a gap that holds for every model and for six of seven classes, from credential and network-policy ($\Delta = 0.95$) to role-based access control ($\Delta = 0.31$); a topology-independent control exhibits no such effect ($\Delta = 0.0$), isolating the result from generic prompt enrichment. Supplying the live service-call graph and the service-account bindings it exposes thus improves remediation of topology-dependent findings well beyond scanner-only context.
