Cloud-Native Blast Radius Analyzer v3 Agentic Threat Modeling in Kubernetes

Abstract

Abstract / Description: This research note provides the formal mathematical specification and operational framework for the Cloud-Native Blast Radius Analyzer (C-NBRA), a specialized cybersecurity tool designed to continuously map, analyze, and mitigate zero-day breaches in Kubernetes environments using Zero Trust Architecture principles. In modern microservice architectures, calculating the exact lateral movement potential of a compromised workload is a complex challenge. C-NBRA addresses this by translating declarative Kubernetes states (Pods, NetworkPolicies, and RBAC rules) into an actionable directed graph G(V,E)G(V,E). This document outlines: Graph-Theoretic Modeling: The mathematical translation of Kubernetes infrastructure into vertices (VV) and edges (EE) representing network reachability and permission sets. State-Aware Blast Radius Computation: The application of Breadth-First Search (BFS) algorithms to calculate the exact blast radius BrBr of a compromised node, evaluating fine-grained Ingress rules and PodSelectors dynamically. LLM GenAI SecOps Integration: The architecture for translating mathematical attack paths into human-readable context for a Large Language Model (LLM) agent, enabling the autonomous generation of YAML isolation policies (NetworkPolicies) while adhering to the "Human in the Loop" principle. System Topology: The end-to-end data flow from the Kubernetes API data collection to graph computation and interactive React D3-force visualization. Advanced Multi-Agent Topology (Active Defense System): Powered by LangGraph (A2A) and the Model Context Protocol (MCP) The Sentinel Agent (Watcher): Continuously ingests kernel-level alerts from Tetragon (eBPF). It performs LLM-driven contextual analysis to filter false positives and triggers the defense loop upon confirming a genuine runtime threat. The Red Team Agent (Attack Mapper): Triggered by the Sentinel, it fetches external threat intel (CVEs/SBOMs) via MCP to exhaustively map ALL possible attack scenarios, outputting every conceivable exploit path an attacker could take through the calculated blast radius. The Blue Team Agent (Mitigator): Uses the Red Team's map to autonomously generate precise Zero-Trust NetworkPolicies that sever those specific attack paths without breaking production. The Arbiter (Prod Safety Agent): Verifies that the Blue Team's policies are safe by leveraging live Prometheus metrics and K8s API Dry-Runs via MCP. This technical note is intended for DevSecOps engineers, Cloud-Native security researchers, and Platform Architects exploring the intersection of Graph Theory, LLMs, and Kubernetes security