BACKGROUND

1. Field

The disclosure relates generally to multi-cluster container orchestration environments and more specifically to controlling access to resources of a multi-cluster container orchestration environment by using an access control policy comprised of resource-permission-role mappings unique to each respective user in the multi-cluster container orchestration environment.

2. Description of the Related Art

A multi-cluster container orchestration environment, such as, for example, Kubernetes, is a system for automatically deploying, scaling, and managing containerized applications across clusters of nodes. The multi-cluster container orchestration environment groups containers, which make up an application, into logical units for easier management and discovery. A group of containers is known as a cluster. One of the containers of the cluster is designated as a master node, which runs control plane processes of the multi-cluster container orchestration environment. The other containers of the cluster are assigned as worker nodes that fall under the control of the master node. The multi-cluster container orchestration environment may also manage clusters of containerized applications, which can span public, private, and hybrid clouds.

Access control is a method of enhancing security of an organization's network by restricting availability of resources to endpoint devices that comply with the organization's security policy. Restricted access to the resources is achieved through user authentication and authorization control. Authentication identifies and authenticates a user to the access control system. Authorization is the process of granting or denying specific access permissions to protected resources by the access control system.

SUMMARY

According to one illustrative embodiment, a computer-implemented method for dynamically enforcing access control policies unique to respective users in a multi-cluster container orchestration environment is provided. A computer generates resource-permission-role mappings for users in the multi-cluster container orchestration environment based on preset access control criteria. The computer learns dynamic access control criteria from the multi-cluster container orchestration environment over time. The computer updates the resource-permission-role mappings for the users in the multi-cluster container orchestration environment based on the dynamic access control criteria learned from the multi-cluster container orchestration environment over time. The computer enforces the resource-permission-role mappings to respective users in the multi-cluster container orchestration environment in response to receiving corresponding user resource access requests. According to other illustrative embodiments, a computer system and computer program product for dynamically enforcing access control policies unique to respective users in a multi-cluster environment are provided.

