Keywords: Microservices, cloud computing, containerisation, orchestration, Kubernetes, Helm Charts

In recent years, there has been an explosion of attacks directed at microservice-based platforms -a trend that follows closely the massive shift of the digital industries towards these environments. Management and operation of containerbased microservices is automation-heavy, leveraging on container orchestration engines such as Kubernetes (K8s). Helm is the package manager of choice for K8s and provides Charts, i.e., configuration files that define a programmatic model for application deployments. In this paper, we propose a novel methodology for extracting and evaluating the security model of Helm Charts. Our proposal extracts a topological graph of the Chart, whose nodes and edges are then characterised by security features. We carry out risk assessments that refer to the attack tactics of the MITRE ATT&CK framework. Furthermore, starting from these scores, we extract the riskiest attack paths. We adopt an experimental validation approach by analysing a dataset created from multiple publicly accessible Helm Chart repositories. Our methodology reveals that, in most cases, they have vulnerabilities that can be exploited through complex attack paths.

Stay at the Helm: secure Kubernetes deployments via graph generation and attack reconstruction Agathe Blaise * , Filippo Rebecchi *

I. INTRODUCTION

Today, containers are widely employed from hyperscalers to private clouds to deploy applications and services, practically replacing traditional Virtual Machines (VMs) as the defacto DevOps standard due to their inherent scalability and portability advantages [START_REF] Vayghan | Deploying microservice based applications with kubernetes: Experiments and lessons learned[END_REF]. Containers rhyme well with cloudnative microservice architectures, whose operating principle differs considerably from the more traditional monolithic approach [START_REF] Newman | Building microservices : designing fine-grained systems[END_REF]. In production environments, the deployment and management of containers are typically delegated to complex automation and orchestration engines such as K8s, Docker Swarm, or AWS Elastic Container Service (AWS ECS). Consequently, this change in paradigm comes with a novel set of challenges and an increased surface of attack [START_REF] Minna | Understanding the Security Implications of Kubernetes Networking[END_REF], exemplified by Man in the Middle (MITM) attacks targeting multi-tenant environments [START_REF]CVE-2020-8554 Man in the middle using LoadBalancer or ExternalIPs[END_REF], or the recent YoYo attack that deliberately abuses the autoscaling of containers [START_REF] David | Kubernetes Autoscaling: YoYo Attack Vulnerability and Mitigation[END_REF].

In this paper we focus on securing K8s deployments, however extending our findings to other engines can follow similar paths. While K8s natively supports some advanced security features, including network segmentation, process isolation, and a Role-Based Access Control (RBAC), in general these policies are not activated by default and require substantial knowledge to be properly configured. Unsurprisingly, insecure practices concerning default configuration are well documented [START_REF] Minna | Understanding the Security Implications of Kubernetes Networking[END_REF], [START_REF] Shamim | XI Commandments of Kubernetes Security: A Systematization of Knowledge Related to Kubernetes Security Practices[END_REF], [START_REF] Silva | Building A Zero Trust Architecture Using Kubernetes[END_REF]. In this respect, various open source and commercial tools help to provide additional layers of security -however, even the most advanced solutions, such as those recommended by the Center for Internet Security (CIS) [START_REF]Aqua security[END_REF], simply consist of a list of pass/fail checks, lacking an overall assessment of the likelihood and impact of an attack. It is therefore not possible to correlate configuration files, user-defined policies, to extract potential points of failure.

Properly configuring K8s deployments can be quite complex. Deployments can be performed either manually via a series of command-line inputs or, in automation-heavy environments, via deployment files such as Helm Charts. Helm is the package manager of choice for K8s, and Charts consist of deployment-ready collections of YAML manifest files that describe the model for deploying the microservice application containers to K8s [START_REF]Helm charts[END_REF]. Charts can be quite complex and can result in behemoth configuration files of up to 40𝐾+ lines of code, virtually impossible to analyse by hand (e.g., [START_REF]kube-prometheus-stack[END_REF]). In addition, the same policy can be defined in multiple places via different fields, an error-prone behaviour in collaborative environments.

The main contribution of this paper is a multi-step methodology to evaluate the security and extract the risk model of a Helm Chart deployment as detailed below:

• Step 1. A basic topological graph is extracted by parsing, analysing, and correlating various components and policies extracted from the Helm Chart. • Step 2. Extracted data is aggregated into six main features, inspired by CIS K8s best practices [START_REF]CIS Benchmark -Securing Kubernetes[END_REF], [START_REF]CIS Benchmark -Securing Docker[END_REF]. An enriched topological graph encompasses a set of nodes and connecting edges characterised by such features. • Step 3. From the topological graph, the risk associated with each node and edge of the graph is evaluated following the possible attacker tactics as defined in the MITRE ATT&CK framework for K8s [START_REF]Threat matrix for Kubernetes[END_REF]. • Step 4. Finally, we use a shortest-path algorithm to roam the risk-graph and to extract the (set of) attack path(s) considered the most dangerous/risky on the topology. We evaluate our methodology via an experimental approach. We have constructed a dataset from multiple publicly accessible Helm Charts repositories. We have implemented a working prototype of our methodology to evaluate the Charts in the dataset. By scoring security features in accordance with CIS benchmark recommendations, we demonstrate that most of them are not secure by default and require substantial modifications to reduce the overall security risks.

The remainder of this paper is structured as follows. Sect. II addresses related work and positions our work. Sect. III

II. RELATED WORK

We focus our attention on the relevant literature in the fields of K8s security and related threats and attack tactics.

A. Kubernetes security management

While simple applications may be composed of only a few tens of components, the largest ones, such as those operated by Netflix [START_REF]A Design Analysis of Cloud-based Microservices Architecture at Netflix[END_REF] and Uber [START_REF] Uber | Introducing Domain-Oriented Microservice Architecture[END_REF], can run hundreds or thousands of containers. Their composition leads to complex interaction patterns that can be a source of security issues. This complexity is well understood by professionals, who require a thorough security assessment of both K8s clusters and microservice configurations before being deployed in production.

By limiting the scope of our analysis to K8s, different approaches exist to audit the security of such configurations. The first category of tools retrieves configuration files and settings and executes a set of checks based on CIS benchmarks, related both to Docker [START_REF]CIS Benchmark -Securing Kubernetes[END_REF] and K8s [START_REF]CIS Benchmark -Securing Docker[END_REF]. The second category executes custom checks for best practices against provided configuration files and settings. Finally, the third category relies on penetration testing (pen-testing) techniques in the K8s cluster. As a summary, Table I lists the main tools for analysing the K8s configuration descriptors. The kubebench tool strictly follows all the checks listed by the K8s CIS benchmark to discover configuration errors and authorisation and authentication issues, while kube-hunter enhances the effectiveness of the analysis with discovery and pen-testing capabilities. Similarly, sKan and checkov rely on the K8s CIS benchmark to execute a set of checks over the configuration and user-defined policies, whereas kAdvisor, kubeaudit, and Polaris check the conformity of K8s objects using their own sets of checks. Finally, Docker Bench limits itself to Docker containers and applies automated checks against common deployment best practices.

Such tools have a number of shortcomings that reduce their effectiveness. First, they only perform a set of checks, without any correlation of the results. For this reason, it is often not possible to diagnose the global impact that a misconfiguration has on the cluster or on the running microservice. Instead, a correlation and aggregation of information from various analyses performed at different levels could allow one to reconstruct a more coherent view of the system. Furthermore, the results of the checks carried out are not put into perspective with the techniques and tactics employed by real-world attackers, for instance following some well-known attack matrices [START_REF]Threat matrix for Kubernetes[END_REF].

Recent works focus on K8s manifests and Helm Charts to point out misconfigurations affecting security. [START_REF] Spillner | Quality Assessment and Improvement of Helm Charts for Kubernetes-Based Cloud Applications[END_REF] examines Helm Charts to assess the quality of declarative chart artefacts, e.g., detecting Charts with no maintainer or with a name collision. [START_REF] Bose | Under-reported Security Defects in Kubernetes Manifests[END_REF] applies a qualitative analysis technique called closed coding to spot security shortcomings of K8s manifests, where two users rate collected commits to determine which ones are related to security defects, e.g., looking for keywords as 'injection' or 'vulnerability'. However, the methodologies developed in both articles require human intervention, and analyse only the commit logs and not the actual content of K8s manifests.

B. Kubernetes threat matrix

The MITRE Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) framework is an up-to-date database of attack techniques grouped by objectives known as tactics. The ATT&CK framework, originally generic, has been specialised for K8s, highlighting multi-stage cyber-attack patterns and techniques that attackers can use to infiltrate and perform damage on K8s clusters [START_REF]Threat matrix for Kubernetes[END_REF]. The threat matrix is made up of ten distinct families of tactics that an attacker can combine to reconstruct and exploit possible attack paths.

Up to our knowledge, the K8s threat matrix has been very rarely used in the literature as a means to efficiently design systems considering real-world attack scenarios. Authors in [START_REF] Minna | Understanding the Security Implications of Kubernetes Networking[END_REF] and [START_REF] Massoud | Threat Simulations of Cloud-Native Telecom Applications[END_REF] introduce several attack scenarios derived from the attack life-cycle introduced in the K8s threat matrix.

C. Our contribution

With respect to related works, our methodology can be assimilated to auditing microservice deployment descriptor files through custom compliance checks. However, our proposal goes far beyond the simple execution of compliance checks, as it generates decorated graphs of the deployment, correlating to each other and enriching the components defined in the configuration file. Additionally, our methodology extracts the most significant risks in the deployment and identifies the riskiest attack paths. In this way, it also acts as a useful tool for the decision-making process, as opposed to other solutions that do not provide any prioritisation of the actions to be taken. Furthermore, our methodology embeds natively the K8s threat matrix to model the security of the deployment and detect potential issues with accurate mapping to real-world attacks.

III. K8S DEPLOYMENT MODEL

K8s automates the management of containers and microservices. However, complexity shifts from properly running ap-plications, to properly configuring their deployment model via descriptor files. In this section, we review the K8s architecture outlining the security best practices to follow.

A. Kubernetes architecture

A container packs together one or more executables and their dependencies. A K8s cluster allows containers to run transparently across multiple (virtual, physical, on-prem, or cloud-based) machines. Each cluster contains at least a master node and one or more worker nodes. Masters have the task of keeping the cluster in the desired state, scheduling the execution of containers on worker nodes, which execute them.

K8s abstracts the configuration of the cluster and the applications deployed on it through a resource-based model. A minority of resources are global, e.g., nodes and cluster roles, but most are scoped through a namespace. The main types of resources defined in K8s include pods, deployments, daemon sets, network policies, (cluster) roles, (cluster) role bindings, persistent volumes, persistent volume claims, secrets, and services.

All interactions between entities (including between administrators, developers, and deployed containers) in the K8s cluster go through an API server, which is the one-stop shop for declaring and managing cluster resources, with the server also handling authentication. Although the API server is the interface, the K8s brain resides in etcd, a distributed key-value store that holds all the states of the cluster (all other components are stateless). Data, including secrets, is not encrypted by default in etcd. Other key components for cluster operation are the scheduler, which assigns execution pods to worker nodes; the kubelet, which runs on each node to ensure the proper functioning of pods programmed by the scheduler; the kube-proxy, which ensures the routing of the traffic for a service IP to the correct pods; and finally the Container Network Interface (CNI), which guarantees the traffic routing between the nodes, the application of network policies, and possibly traffic encryption1 .

B. Security best practices

As with any system, container engines and orchestrators may have vulnerabilities. Nonetheless, most of the critical security issues are attributable, directly or indirectly, to the exploitation of vulnerabilities and misconfigurations in userdeployed applications. As a matter of fact, although the abstraction layer added by K8s reduces the complexity of managing software and hardware resources, it can help increase the attack surface if set up improperly [START_REF] Jayasinghe | A Survey of Attack Instances of Cryptojacking Targeting Cloud Infrastructure[END_REF]. For this reason, it is important to clarify the best practices to follow in the management of K8s clusters and the applications deployed on them [START_REF] Shamim | XI Commandments of Kubernetes Security: A Systematization of Knowledge Related to Kubernetes Security Practices[END_REF]. These best practices lay the foundation for the analyses that constitute the methodology for evaluating the security of Helm Charts that we propose.

Pod Security Policy (PSP):

The PSP mechanism allows defining security policies on pods running on the cluster. These policies are useful to restrict the resources one can define, e.g., prohibiting containers from accessing the Linux namespaces of the host, prohibiting the use of the root accounts in containers, or controlling the Linux capabilities of pods.

Secrets management: Secrets store sensitive information that can be accessed by running pods, such as passwords, authentication tokens, or keys. Secrets should be accessible only by the applications needing them. Network access to etcd and other administrative interfaces should also be filtered through Network Policies (NPs). Access to etcd by API servers should be protected by mutual authentication. The local mounting of secrets and control sockets stored on nodes should be prohibited via a PSP.

Access to K8s services: Core K8s services, such as the DNS and the API server, are deployed in the kube-system namespace. By default, they are accessible from any other namespace. Therefore, a best practice is to prevent any traffic from other namespaces to reach kube-system via explicit NPs, with the exception of the applications that really require access to those services.

Access Control: The permissions granted to users and applications should be reduced as much as possible to prevent them from interacting with the cluster configuration, in particular the API server. Service accounts handle users with authentication based on tokens, which are automatically mounted by default and made available in the containers. RBAC policies control the access to APIs exposed by the API server. Roles can be defined with (cluster) role resources to authorise a list of paths (endpoints) and possible actions on each path (HTTP verbs: get, list, watch, update, etc.). Roles are assigned to service accounts, users or groups, by the declaration of (cluster) role bindings.

IV. MODEL RECONSTRUCTION FROM MICROSERVICE DEPLOYMENT DESCRIPTORS

The overall methodology is composed of 4 steps:

• Step 1: Parse the descriptors files and correlate various resources to extract a basic topological graph composed of nodes and edges; • Step 2: Enrich the topological graph through six main features in line with the CIS K8s best practices, namely: 1) vulnerabilities of containers, 2) pods accessibility, 3) the security policies in places among pods, 4) access control (RBAC) rules, 5) firewall rules, and 6) affinities among deployed components; • Step 3: Score the level of danger associated to the topological graph for each attacker tactic from the K8s threat matrix; • Step 4: Identify the riskiest attack paths according to each step of the attack scenarios defined at the previous step.

Fig. 1 provides an overview of the overall methodology, with the four main steps detailed in the following.

A. Helm Chart parsing and graph extraction

The first step has the double objective of parsing the Helm Chart to feed a data structure holding the overall deployment system resources and to build topological information about how resources of a deployment are correlated together. Let 𝑆 represent the overall deployment system, composed of multiple resources as defined in Table II, such that:

𝑆 = {P, N , C, S𝑣, A, R, R𝑐, B, B𝑐, P𝑠, N 𝑝, S𝑐, V, M, P𝑣, P𝑐}
We describe in Table III the notations we use in the paper. These resources can be related together using formal constraints, that are expressed as follows:

• each resource 𝑟 ∈ 𝑆 belongs to a unique namespace 𝑛 ∈ N ; • each pod (or deployment) 𝑝 ∈ P encapsulates at least one (initial) container 𝑐 ∈ C and a volume 𝑣 ∈ V shared By correlating all the resources of the system together, we can build a topological graph with a coherent set of resources. Let G({C ∪P}, E) be a directed graph with vertices representing the union of containers C = {𝑐 1 , 𝑐 2 , ..., 𝑐 𝑛 } and pods P = {𝑝 1 , 𝑝 2 , ..., 𝑝 𝑚 } present in the K8s deployment. The set of edges E connecting the vertices is created as follow:

• A directed edge 𝑒( 𝑝, 𝑐) is created from pod 𝑝 ∈ P towards the container 𝑐 ∈ C that it encapsulates; • A directed edge 𝑒( 𝑝 1 , 𝑝 2 ) is created between each pair of pods 𝑝 1 , 𝑝 2 belonging to P. Considering several configurations, including network policies, pod execution permissions, and co-localisation of pods on the same K8s node, pod-to-pod edges model the ability to move from one pod to another. Following the application of the list of relations between all resources, each resource 𝑟 ∈ {N , C, S𝑣, A, R, R𝑐, B, B𝑐, P𝑠, N 𝑝, S𝑐, V, M, P𝑣, P𝑐} is directly linked to a pod 𝑝 ∈ P or linked to a resource itself linked to pod 𝑝, so that a coherent set of the aforementioned resources may be created around a single pod.

B. Graph enrichment

The second step has the objective to enrich the previously generated topological graph G via the analyses of the resources stored in 𝑆.

Let G({C ′ ∪ P ′ }, E ′ ) be an enriched directed graph with C ′ the set of enriched containers and P ′ the set of enriched pods. Each 𝑐 ′ ∈ C ′ has a set 𝛼 of attributes derived from the graph enrichment made from various security analyses. An enriched container is a container along with additional information describing it, provided from other resources related to it. Similarly, each 𝑝 ′ ∈ P ′ has a set 𝛽 of attributes derived from the graph enrichment process. An enriched pod has additional information describing it, provided by other resources related to it.

Let

E ′ = {𝑒 ′ 1 , 𝑒 ′ 2 , ..., 𝑒 ′ 𝑜 } with 𝑜 = |E ′ |.
Each 𝑒 ′ ∈ E ′ has a set 𝛾 of attributes derived from the graph enrichment. Let F = { 𝑓 1 , 𝑓 2 , ..., 𝑓 𝑖 } (𝑖 = |F |) be the set of functions applied to resources of S to perform various security analyses and compute attributes 𝛼, 𝛽, and 𝛾 of resources belonging respectively to C ′ , P ′ , and E ′ . A non-exhaustive list of security analysis functions may include:

• Vulnerability scan of containers:

𝑓 1 : C → C ′ .
The number of high or critical severity vulnerabilities, i.e., those whose Common Vulnerability Scoring System (CVSS) score is greater than 7, associated with each container is recorded. Image vulnerability scanning is the process of reviewing the security state of the container images. Image vulnerability scanners retrieve the Operating System (OS), software packages and libraries used in an image and compare them against vulnerabilities repositories. We leverage on open source tools such as Trivy [START_REF] Security | [END_REF], Docker Scan [START_REF] Docker | Vulnerability scanning for docker local images[END_REF], and Snyk [START_REF] Snyk | Snyk: Develop fast. Stay secure[END_REF]; • Services associated with pods: 𝑓 2 : {P, S𝑣} → P ′ .

The services abstract the accessibility rules of pods: these can be exposed only inside the cluster (ClusterIP), or externally to the cluster via a static port (NodePort), an external load balancer (LoadBalancer), or an HTTP routing service (Ingress); • Pod security policies and security context of containers and pods: 𝑓 3 : {C, P, P𝑠, V, M, P𝑣, P𝑐} → P ′ . This category embeds information on the pods' and containers' environment, including the authorised and prohibited Linux capabilities, the different types of authorised volumes, the permissions associated with files (readonly or write), the authorised users, e.g, root account or not, the permission or restriction to launch privileged containers, the authorised or unauthorised use of the host machine's network, the list of authorised ports, the authorised or unauthorised use of the host Inter-Process Communication (IPC) and Process ID (PID) namespaces, etc.; • Service accounts associated with pods and their permissions:

𝑓 4 : {P, A, R, R𝑐, B, B𝑐} → {P ′ , E ′ }.
As defined in Sect. III-B, these permissions include a list of endpoints and possible actions on each endpoint, e.g., creating new pods and workloads, reading secrets, executing other pods, etc.;

• Network policies: 𝑓 5 : {P, N 𝑝} → E ′ .
They define firewall rules governing the interactions between the pods, e.g., which pods can communicate with each other, on which port and which protocol; • Pod affinities between different pods: 𝑓 6 : P → E ′ .

They represent the fact that two pods must be located on the same machine (pod-affinity), or on the contrary on two different machines (anti pod-affinity).

C. Graph weighting and scoring

The third step has the objective of quantifying the security level of a Helm Chart, deriving information from the enriched graph computed at the previous step. The process of scoring is actually related to computing weights associated with each node and edge of the enriched graph. Two distinct scoring systems are provided, reflecting different levels of detail.

1) Single-weight scoring system: The first scoring technique associates a single weight to each node and each edge of the enriched graph. This aims to model the overall risk level associated with each component, aggregating all the security assessments into a single value.

Let W ({C ′ ∪ P ′ }, E ′ , 𝑤, 𝑧) be an edge-and node-weighted enriched directed graph derived from G({C ′ ∪ P ′ }, E ′ ). Let 𝑤 : {C ′ ∪ P ′ } → R and 𝑧 : E ′ → R be the single-weighting functions respectively for nodes and edges of the graph. If (𝑢, 𝑣) ∈ E ′ , 𝑧(𝑢, 𝑣) ∈ [0, 1] as weights represent probabilities and are multiplicative. For convenience, we define 𝑧(𝑢, 𝑣) = 0 if (𝑢, 𝑣) ∉ E ′ .

2) Multiple-weight scoring system: The second scoring technique is more complex, as it evaluates the components with respect to the offensive tactics and techniques of the K8s threat matrix [START_REF]Threat matrix for Kubernetes[END_REF] introduced in Sect. II-B. For each node and edge of the enriched graph, a sub-score is assigned for each tactic of the matrix. Let W ′ ({C ′ ∪ P ′ }, E ′ , 𝑤 ′ , 𝑧) be an edge-and node-multiweighted enriched directed graph derived from G({C ′ ∪ P ′ }, E ′ ). Let 𝑤 ′ : {C ′ ∪ P ′ } → R 𝑞 be the multi-weighting function for nodes of the graph, with 𝑞 the number of tactics of the K8s threat matrix that are evaluated, and 𝑧 : E ′ → R the single-weighting function for edges of the graph. Especially, 𝑤 ′ (𝑛) = {𝑤 ′1 (𝑛), ..., 𝑤 ′𝑡 (𝑛), ..., 𝑤 ′ 𝑗 (𝑛)} with 𝑤 ′𝑡 (𝑛) the multi node-weights of node 𝑛 for tactic 𝑡. As before, let 𝑧(𝑒) be the single edge-weight of edge 𝑒.

The weighting functions can be customised by the administrator. As an example, Fig. 2 illustrates a possible weighting system. In this setting, nine tactics from the K8s threat matrix are considered. The Initial Access and Execution tactics are first employed to model the ability for an attacker to enter a pod of the cluster and execute malicious actions. Then, several end-goal tactics that the attacker may perpetrate on the cluster are considered, and in particular Privilege Escalation, Defence Evasion, Credential Access, Discovery, Impact, and Lateral Movement to host. The ability to move to other pods is also considered as an end-goal tactic via the Lateral Movement to pod. The final weight for each end-goal tactic of Pod A equals the product of the weights associated to each sub-node on the path. For example, the final weight denoted 𝑤 ′𝑝𝑟_𝑒𝑠𝑐 ( 𝐴) of the end-goal Privilege Escalation (𝑝𝑟_𝑒𝑠𝑐) is the product of 𝜔, 𝛽 1 , 𝛽 2 , and 𝛼 2 . Also, the initial weight of Pod B equals the output weight of the Lateral Movement to pod from pod A, so that 𝑧 ′ ( 𝐴, 𝐵) = 𝑤 ′𝑙𝑎𝑡_𝑚𝑜𝑣 ( 𝐴).

D. Identification of dangerous attack paths

The fourth and final step has the objective to find a set of one or more attack paths that are considered the most risky. By employing the weights defined in step 3, the objective is to find the path 𝑠 = ⟨𝑛 1 , 𝑛 2 , 𝑛 3 , . . . , 𝑛 𝑘-1 , 𝑛 𝑘 ⟩ that maximises the weight 𝑧(𝑛 1 , 𝑛 2 ) • 𝑧(𝑛 2 , 𝑛 3 ) • ... • 𝑧(𝑛 𝑘-1 , 𝑛 𝑘 ). Given that edge weights represent probabilities, the objective is to find the set of acyclic paths with the largest aggregate score.

max 𝑝 𝑒 ∈ 𝑝 𝑧(𝑒) (1)
Inverting the edge weight transforms it into a minimisation problem, which consists of finding the shortest path by product of edge distances. Further, by taking the logarithm of edge distances to make summation, the final problem becomes a shortest path problem, so that:

min 𝑝 ∑ 𝑒 ∈ 𝑝 log( 1
𝑧(𝑒) ) (2)
We employ Dijkstra's algorithm to find the shortest path between several nodes of our graph [START_REF] Dijkstra | A note on two problems in connexion with graphs[END_REF], [START_REF] Jiang | Extending Dijkstra's shortest path algorithm for software defined networking[END_REF].

V. EVALUATION

For evaluating our methodology, we have built a dataset of Helm Chart configurations from multiple publicly available repositories. The evaluation employs our methodology to assess the adherence of the Charts in the dataset to common K8s security best-practices. We also highlight the results of the analysis on specific Helm Charts showing how our methodology can help pinpointing typical misconfigurations.

A. Dataset

Helm [START_REF]Helm charts[END_REF], [START_REF] Spillner | Quality Assessment and Improvement of Helm Charts for Kubernetes-Based Cloud Applications[END_REF] is the equivalent of a package manager for K8s and employs a packaging format called Charts. A Helm Chart packs a set of (deployment-related) K8s resources into a single YAML configuration file. Thus, a single Chart might be used to deploy something simple, like a Memcached pod, or even a full web app stack with multiple server replicas, databases, caches, load balancers, and so on.

The dataset is built by scraping and assembling the Helm Charts from 14 open-source repositories 3 , namely prometheuscommunity, kube-state-metrics, renovate, artefact, hashicorp, enix, klustair, camunda, hpe-storage, nutanix, bitnami, halkeye, ibm-charts, and helm-charts. In total, the collected dataset consists of 592 official Helm Charts, totalling 1076 pods and 1318 containers. These represent the basic targets of our analysis. We observe that configuration files of Helm Charts in the dataset can contain up to 43,628 lines, with an average of 564 lines per Chart. Of course, the interesting ones are those with the largest numbers of pods, as they have the most complex interactions between pods and the largest numbers of lines to analyse, which therefore require considerable effort in the case of manual analysis.

B. Compliance with the Kubernetes CIS benchmark

The K8s CIS benchmark proposes prescriptive guidance for establishing a secure configuration posture for K8s [START_REF]CIS Benchmark -Securing Kubernetes[END_REF]. Among other configurations, the benchmark covers RBAC and service accounts, PSPs, network policies and CNIs, secrets management, extensible admission control, and general policies. We aim to assess how the Helm Charts in our dataset comply with these sets of rules. Table IV summarises the number of containers we identified as not compliant with the rules of the CIS benchmark, using the parsing of K8s resources made by our tool. We observe that for several rules a large share of containers does not comply with them.

In fact, root containers are around a third of the total, which is quite concerning as they greatly facilitate the job of escalating privileges once an attacker has reached a container. The proportion of privileged containers is also concerning. Furthermore, in most configurations, all 14 Linux capabilities granted by default to containers are allowed, with no restrictions on the most harmful ones. For example, the NET_RAW capability allows the exchange of ICMP traffic between containers, granting as well a container the capability to craft raw packets. Regarding RBAC and service accounts, around 10% of all containers have the capability to retrieve the list of secrets, the list of running pods, and to create pods. Finally, the abilities to access the host network and to mount volumes on the host are granted in around 1% of all cases, which is quite reasonable. Fig. 3 shows the distribution of the number of high or critical severity vulnerabilities (CVSS > 7.0) found per container image present in the Helm Charts, by employing image vulnerability scanners. The red bar on the left represents opaque containers, i.e., container images that Fig. 3: Distribution of the number of vulnerabilities per container for all the container images in the Helm Charts. cannot be analysed by image vulnerability scanners 4 . Moreover, we observe that the median number of high or critical severity vulnerabilities is centred around 100, reaching in some cases 3000 vulnerabilities for a single container, e.g., 'unguiculus/docker-python3-phantomjs-selenium:v1' (3282 vulnerabilities), 'halkeye/slack-resurrect:v0.1.4' (2265 vulnerabilities), and 'k8s.gcr.io/spark:1.5.1_v3' (1682 vulnerabilities). Vulnerabilities of containers represent critical entry doors that attackers can leverage to infiltrate a cluster, and therefore should be taken into account in the analysis of the overall cluster security.

To summarise, we observe that a large portion of the Helm Charts in our dataset does not conform to some of the recommendations provided by the K8s CIS benchmark. While this is already worrying by itself, we also point out that simple compliance does not guarantee the absence of security problems and potentially harmful attack sequences. In reality, the main problem lies in the non-correlation of the different elements of the analysis into a single global model that synthesises the information. In fact, single scans can overlook important insights such as the most important assets to protect, the most critical security gaps to address, and which problems have to be resolved first. In addition, the resilience of each configuration to various possible attack tactics is not assessed. Therefore, our model correlating the components, outputting graphs and deriving risky attack paths is necessary to get an accurate vision of the overall level of defence and risk of the configuration.

C. Connectivity among components

Hereafter, we aim to illustrate the necessity to take into account the connectivity between components in our analysis. A pod might be reachable by an attacker from the outside if the service associated with it is "NodePort" or "LoadBalancer", meaning that components located outside the cluster can potentially reach it. Afterwards, the possibility for an attacker to move inside the cluster, e.g., from one pod to another, and thus to reach several pods from a single entry point, should also be considered. This agility can be made possible by the lack of network policies implemented, to high-privileged users permissions enabling to execute other pods, or to pod affinities co-locating several pods on the same node. Table V reports the number of reachable containers, including the numbers of initially reachable ones (due to their service accessibility configurations) and of the ones reachable by transitivity due to the three aforementioned techniques. Initially, 134 out of the 1318 containers in the dataset are potentially reachable from the outside considering only their service accessibility. Considering pod execution permissions enables to reach only one additional container, which means that most high-privileged pods are well isolated. Then, 293 containers are reachable in total considering the lack of network policies and 315 ones considering pod affinities. In total, 315 containers are reachable considering the ability of the attacker to move in the cluster due to all these factors, which represent an increase factor of 2.35. Note that the ability for an attacker to move across pods can be more accurately weighed depending on the employed technique, e.g., the lack of network policies between two pods would give the attacker 80% of a chance to move, while the pod execution permission would give the attacker 100% success rate.

D. Considering K8s threat matrix tactics individually

As just mentioned, the coefficients associated with each setting can be tuned to weigh the importance of each step in the attack life-cycle, so that the global score equals the weighted sum of all attributes. Table VI shows the values of the coefficients chosen for each setting.

Fig. 4 breaks down the danger scores produced by the scoring module, including the global score (e.g., the singleweight score defined in Sect. IV-C1) and the multiple subscores related to the K8s threat matrix tactics (as defined in Sect. IV-C2). The large red dots picture the overall danger level of the containers' configuration, considering the various security configurations related to it. By extension, the container inherits from security configurations of the pod that encapsulates it. The blue dots represent the number of vulnerabilities of the containers. Numerous values around 100 actually represent the containers that could not be scanned by state-of-the-art tools. The orange dots relate to the "Execution" tactic, acknowledging the ability of a user to run as root in the container or not. The green dots correspond to the number of Linux capabilities granted to containers, ranging The red squares relate to the "Service Accessibility" tactic, whether the pod may be accessible from the outside or not. The purple squares represent the "Privilege Escalation" tactic, whether the user can escalate its privileges or not, e.g., the field 'allow_privilege_escalation' or 'privileged' is present in the PSP or the user can create bindings. The brown squares correspond to the "Permissions" tactic, including defence evasion, credential access, discovery, impact (create), and impact (delete). Values equal to 0 are not shown in the figure because of the logarithmic scale.

We observe that the first 150 containers have a global danger score higher than 300, which is very concerning. Then, the danger scores are slightly decreasing, reaching values located between 100 and 300. Finally, a hundred containers have low danger scores, lower than 200. The global danger score gives a good overview of the security of a pod, but heterogeneous reasons may hide behind high danger scores. Three illustrative examples of pods retrieved from Helm Charts' configurations with rather similar high danger scores are provided hereafter:

(𝑖) The pod named "node-exporter" (score: 470) from Chart "kube-prometheus" released by "bitnami" can access the host machine's network on all ports, can share the host PID, and can mount and write on volumes on the host;

(𝑖𝑖) The pod named "pachd" (score: 411) from Chart "pachyderm" released by "stable" is privileged and is associated with a service account with many permissions in the cluster, including the abilities to get secrets and to get, delete, and create pods;

(𝑖𝑖𝑖) The pod named "ibm-skydive-dev-analyzer" (score: 232) from Chart "ibm-skydive-dev" released by "ibmcharts" has been granted 5 additional Linux capabilities, i.e., SYS_ADMIN, SYS_RESOURCE, SYS_TIME, NET_BROADCAST, NET_ADMIN, in addition to the 14 default ones, reaching 19 capabilities in total. A user in the pod can potentially modify the network interface on the host and can get a root session on the host machine.

E. Reconstructing complete attack paths

Threat matrix tactics considered individually can help us identify alarming configurations in the Helm Charts, but by themselves they do not provide sufficient visibility to the overall risk of a given attack or threat. Indeed, refined attacks follow complex patterns that involve multiple steps.

In the following, we employ the methodology defined in Section IV-D to assess the number of containers vulnerable to different tactics as end-goals. For this analysis, we distinguish between two settings, namely initially reachable containers and complete attack paths, defined as follows:

• Initially reachable containers: this setting does not consider edges between pods. The weight of each of the nodes equals the product of its service accessibility and the score of the given K8s threat matrix tactic's score.

The service accessibility value is Boolean, e.g., either 0 (if the service is 'ClusterIP') or 𝛽 1 (otherwise). • Complete attack paths: this setting considers all edges between pods, so that complete attack paths can be reconstructed. The weight of the initial pod on the path equals the value of its service accessibility, e.g., either 0 or 𝛽 1 . The weights of the edges are located between 0 and 1, and the weights of intermediate pods are set to 1.

The weight of the final pod equals the score of the given tactic's score for the pod. Fig. 5 illustrates a breakdown of the global scores calculated for each container by attack tactic. Fig. 5a plots the results for the initially reachable containers setting, while Fig. 5b considers the complete attack paths setting. In Fig. 5b, the plotted values represent the maximum score among all the possible shortest paths by destination container. The differences between the two figures are therefore attributable to the accounting of complete attack paths which extends considerably the scope of an attack to a significantly larger fraction of containers.

An extension to this model recognises the possibility for an attacker to gain access to pods even without them being exposed to the outside world. This is possible by exploiting e.g., supply-chain attacks, vulnerabilities present in K8s, or in containerisation technologies. To model this situation, a parameter 𝜔 is introduced to represent the default accessibility value of a pod for the attack path computation. Until now, Service Accessibility was set to 0 when the service type was defined as 'ClusterIP'. 𝜔 is a probability, e.g., a value of 0.1 would mean that the pod may be accessible by an attacker with a 10% chance even if the service is 'ClusterIP'. Table VII provides the number of containers vulnerable to the different tactics, for 𝜔 = 0 and only initially reachable containers (e.g., as in Fig. 5a), 𝜔 = 0 and complete attack paths (as in Fig. 5b), and 𝜔 > 0. Using 𝜔 > 0, we observe that far more containers are vulnerable to the various attacker tactics. Risks are even more prominent for the three tactics "Access to host's network, paths, and volumes", as respectively 72, 13, and 10 containers may be leveraged to perform such tactics.

VI. CONCLUSION AND PERSPECTIVES

The emergence of cloud-native microservices architectures and orchestration engines such as K8s comes with a whole set of security challenges that need to be addressed. In this paper, we present a novel methodology to analyse a K8s Helm Chart deployment. The proposed methodology translates Helm Charts into topological graphs, performing on it various security analyses, outputting a security score and a set of risky attack paths backed by the MITRE ATT&CK framework. We evaluated our methodology via an experimental approach, demonstrating its applicability to hundreds of Helm Charts that contain delicate points whose developers should be aware.

Future research directions are manifold. First, our methodology can benefit from improved mechanisms to analyse container vulnerabilities. Currently, we are not always able to scan some containers which are therefore flagged as "opaque" and risky. Furthermore, attack paths reconstruction opens up interesting perspectives in terms of automated remediation and prioritisation of fixes. Finally, an applied perspective is to integrate our methodology as a step of a CI/CD security pipeline dedicated to K8s.

Fig. 1 :

 1 Fig. 1: Overview of the proposed multi-step methodology. Step 1: Parsing, correlation of the components, and basic topological graph extraction. Step 2: Graph enrichment through six analysis. Step 3: Scoring of the level of risk associated to each node and edge of the graph (two distinct scales). Step 4: Identification of the riskiest attack paths.

  VariableDescription S Resources from the overall deployment system F Functions applied to resources of S C ′ Set of enriched containers P ′ Set of enriched pods E ′ Set of enriched edges 𝑤 Single-weighting function for nodes 𝑤 ′ Multi-weighting function for nodes 𝑧 Single-weighting function for edges G ( { C ′ ∪ P ′ }, E ′ ) Enriched directed graph W ( { C ′ ∪ P ′ }, E ′ , 𝑤, 𝑧) Edge-and node-weighted enriched directed graph W ′ ( { C ′ ∪ P ′ }, E ′ , 𝑤, 𝑧) Edge-and node-multi-weighted enriched directed graph

Fig. 2 :

 2 Fig. 2: Multiple-weight scoring system.

Fig. 4 :

 4 Fig. 4: Breakdown of scores produced by the scoring module (logarithmic scale).

  (a) Initially reachable containers. (b) Considering all possible paths toward the containers.

Fig. 5 :

 5 Fig. 5: Comparison between initially reachable containers and complete attack paths (logarithmic scale).

Fig. 6

 6 displays three examples of output graphs produced by our methodology and a representation of risky attack paths. Note that only partial information about nodes is provided for better readability. Fig. 6a outputs the graph for the "springcloud-data-flow" Chart from "stable" repository, with 5 pods and 9 containers in total. The complete attack path may be reconstructed from the beginning. Pod D can be reached from Tactic Example 𝜔 = 0 𝜔 = 0 with reachability 𝜔 > 0 Initial access spring-cloud-data-flow (stable); Fig. 6a 122 122 1318 Execution spring-cloud-data-flow (stable); Fig. 6a 103 252 1112 Privilege escalation -Capabilities spring-cloud-data-flow (stable); Fig. 6a 4 13 92 Privilege escalation -Run as root pachyderm (stable); Fig. 6b 112 285 1194 Permissions spring-cloud-data-flow (stable);

Fig. 6 :

 6 Fig. 6: Output of our methodology, with the description of the components and the reconstruction of attack paths.

TABLE I :

 I Classification of state-of-the art tools for microservice descriptor files analysis.provides hints on how a microservice is built in K8s, outlining the security best practices to adopt. Sect. IV details the graph generation methodology. Sect. V presents the evaluation of the methodology, introducing the dataset that we used, and the analysis carried out. Finally, Sect. VI draws conclusions and points out future work.

TABLE II :

 II Resources of the K8s model.

TABLE III :

 III Notations. each service 𝑠 ∈ S𝑣 targets at least one pod 𝑝 ∈ P; • each (cluster) role binding 𝑏 ∈ {B ∪ B𝑐} links a (cluster) role 𝑟 ∈ {R ∪ R𝑐} to a list of subjects (users, groups, or service account 𝑎 ∈ A); • each PSP 𝑝 ∈ P𝑠 characterises the security context of at least one pod 𝑝 ∈ P; • each pod 𝑝 ∈ P is associated with at least one PSP 𝑝 ∈ P𝑠 or with a security context in its definition; • each NP 𝑛 ∈ N 𝑝 links one pod 𝑝 ∈ P to others pods 𝑝 ∈ P, namespaces 𝑛 ∈ N , or IP blocks.

	among the containers 2 ;

• each volume 𝑣 ∈ V is associated with a volume mount 𝑚 ∈ M that specifies where to mount the volume on the containers;

• each persistent volume claim 𝑐 ∈ P𝑐 consumes a persistent volume 𝑣 ∈ P𝑣; •

TABLE IV :

 IV Number and proportion of containers (out of 1318 in total) not complying with K8s CIS benchmark rules.

TABLE V :

 V Number of reachable containers (out of 1318 containers in total) considering various configurations.

TABLE VI :

 VI Values of coefficients chosen for each setting. between 0 and 19. The average number equals 14, coinciding with the capabilities granted to Docker containers by default.

TABLE VII :

 VII Number of containers vulnerable to each K8s threat matrix tactic, for three configurations.

It is worth noting that CNIs are not part of the core K8s components and are enabled through external plugins.

In K8s, a pod is the encapsulation of tightly bounded containers, with shared storage, a unique IP address, and options that control how the container(s) should perform. A deployment provides declarative updates for pods. We will refer as "pod" to talk about pods, deployments, daemon sets, stateful sets, and replica sets in the remainder of the article.

Helm Charts from a given repository can be downloaded via the command line helm repo add <repo-name> <repo-url>.

Typically, a container image cannot be analysed for the following reasons: (𝑖) the image's footprint has been minimised, (𝑖𝑖) the image has been made from scratch, (𝑖𝑖𝑖) the base image is outdated, or (𝑖𝑣) the base image is too recent and not yet handled by the analysis tool.

ACKNOWLEDGMENT

This work is funded under the Assurance and certification in secure Multi-party Open Software and Services (Assure-MOSS) Project (https://assuremoss.eu/en/), with the support of the European Commission and H2020 Program, under Grant Agreement No. 952647.


Joost De Moor

Mattias Wahlström

Maria Grasso

Marco Giugni

Environmental Movements and Their Political Context

Environmental movements are in various ways shaped by their political context, typically conceptualized by scholars as the political opportunity structure (POS). In addition to presenting a review of research on the complex relationship between POS and environmental movements, this chapter provides an analysis of several emblematic climate mobilizations of the late 2010s to elaborate on some largely neglected aspects of POS theory. These include (1) how movements translate POS into strategies through narratives of interactions with governmental institutions; (2) how not only input structures but also output structures of governmental institutions need to be taken into account to understand environmental movements' strategic choices; and (3) how POS may come to play a less significant role when movements shift from a predominantly instrumental logic to an increasingly moral/expressive logic.

Introduction

Amid sometimes fierce theoretical debates, there is nevertheless broad scholarly agreement that social movements are shaped by their political context. Environmental movements are no exception in this respect. In this chapter we discuss the relationship between political context and environmental movements using the concept of the political opportunity structure (POS).

While environmental movements' contextual embeddedness has been studied from a variety of angles, including 'political culture' (e.g., Jamison et al. 1990), POS has been by far the most prolific approach in the social movement literature. For better or worse, it also captures a broad range of elements in the political context, thus meriting our full attention here.

In the following, we therefore begin by teasing out the central aspects of the POS and discuss what the main mechanisms are through which POSs influence movements. We argue that a better understanding of those mechanisms is needed to make sense of some of the contradictory findings in previous studies and to provide a more robust theoretical framework. Here, a first argument we introduce is that scholars should consider how movements draw conclusions about POS from narrated experiences of interactions with government institutions, and how these narratives are embedded in collective identities.

Thereafter we turn to a literature review of how various political contexts have impacted on the mobilization, strategies and outcomes of environmental movements. A second argument we introduce is that whereas much work has been done on the effect of input structures (governmental institutions' openness to movement demands), differences in output structures (the capacity of governmental institutions to produce change) have been overlooked.

Finally, we use the climate movement as an example to demonstrate these two arguments.

We show how variations over time of (perceived) POSs on the international level changed movement strategies. However, introducing our third main argument, we also suggest that the wave of climate protests at the end of the 2010sprominently represented by Fridays For Future and Extinction Rebellionseems to be strongly driven by a widespread sense of moral obligation to protest. This moral focus may render political opportunities less central.

Political opportunity structures and social movements

During the last decades, the concepts of political opportunities and political opportunity structures (POS) have been the predominant way of theorizing the effect of political context on social movements. However, there are persistent disagreements about either what aspects of the POS are most consequential or how they shape mobilizations. In his original formulation of the term "structure of political opportunities", Eisinger described it as "elements in the environment [that] impose certain constraints on political activity or open avenues for it, which he specifies as "the openings, weak spots, barriers, and resources of the political system itself" (1973: 11-12). Since the term "structure" has been associated with the more stable aspects of the political context, some authors have preferred the term "political opportunities" to capture also its sometimes volatile elements (e.g. Tarrow 1998: 77).

Following Koopmans' definition of political opportunities as "options for collective action, with chances and risks attached to them" (1999: 97), we argue that an "opportunity" can only exist in relation to specific goals and aims of a political actor [START_REF] Goodwin | Caught in a Winding, Snarling Vine: The Structural Bias of Political Process Theory[END_REF][START_REF] Meyer | Conceptualizing political opportunity[END_REF]. Nonetheless, it can be maintained that there are elements of the political sphere that condition political opportunities. Such elements may be structural in the sense that they are beyond the direct influence of movement actors. Some are rigid and only slowly changing (such as election systems and a degree of governmental decentralization), others potentially more volatile (such as elite allies in power and divisions among elites).

Whether a combination of such elements provides sufficiently good chances to constitute an opportunity can only be determined by movement actors considering if and how to take political action. Some authors have had very broad notions of what constitutes the POS, including such factors as societal myths, zeitgeist and media discourse (e.g. [START_REF] Gamson | Framing political opportunity[END_REF]. In order to maintain some consistency with the (admittedly still broad) mainstream of POS research we think that the term POS should be reserved for opportunity structures related to governmental institutions. This way POS is distinguished from other relevant contextual factors influencing movements, such as discursive opportunity structures [START_REF] Koopmans | Discursive Opportunities and the Evolution of Right-Wing Violence in Germany[END_REF], legal opportunity structures [START_REF] Hilson | New social movements: the role of legal opportunity[END_REF] and corporate opportunity structures [START_REF] King | A Social Movement Perspective of Stakeholder Collective Action and Influence[END_REF][START_REF] Wahlström | Between the State and the Market: Expanding the Concept of 'Political Opportunity Structure[END_REF]. McAdam and Tarrow highlight the following aspects of a regime which affect what political opportunities contenders might perceive:

(1) the multiplicity of independent centers of power within the regime; (2) its openness to new actors and movements; (3) the instability of current political alignments; (4) the availability of influential allies or supporters; (5) the extent to which the regime suppresses or facilitates collective claims; and (6) changes in these properties. (2018: 21) These aspects largely meet our definition of structures as 'existing independently' and 'being beyond the direct influence of movement actors', while varying in their stability. The more volatile factors are often related to the configuration of the more stable ones. For instance, the Green Party often presents a significant elite ally for environmental movements that can be voted in or out of office, but the party's electoral chances are determined by stable factors like proportionality.

While much research on POSs has focused on the national level, research has also dealt with different levels of POS, including city, municipality, and international political opportunity structures (IPOS) [START_REF] Van Der Heijden | Globalization, environmental movements, and international political opportunity structures[END_REF]. A basic distinction is furthermore made between input structures -which condition a political actor's access to a polity, and output structures the capacity of a governmental institution to implement policies. While the former has drawn by far the most attention, the latter may be as important for explaining variation in environmental mobilizations. For example, international organizations such as the UN may be relatively open to environmental demands, but have been rather weak in implementing and enforcing environmental policy [START_REF] Van Der Heijden | Globalization, environmental movements, and international political opportunity structures[END_REF], motivating various climate movement groups to ignore the institution and target presumably more powerful actors like fossil fuel companies (de Moor 2018; de Moor and Wahlström 2019).

There has been a long-standing debate regarding the causal mechanisms bringing about the various effects of POS on mobilizations. Some argue that objective conditions belonging to the POS can have a direct effect on mobilizations, regardless of the extent to which they are known by activists. In some cases, movements may be "consistent champions" [START_REF] Meyer | Protest and Political Opportunities[END_REF] that experience political impact when the POS opens up. It is easy to imagine a movement mobilizing a campaign initially unaware of the presence of a new ally in the political system which eventually facilitates the realization of its demands. Similarly, [START_REF] Koopmans | The missing link between structure and agency: Outline of an evolutionary approach to social movements[END_REF] has proposed an 'evolutionary' model, according to which the POS provides a habitat that determines which mobilizations and which repertoires of action "survive" over time.

However, with respect to movement strategies and levels of mobilization it seems that the most widely held position is that POSs need to be perceived and interpreted by movement actors in order to have an effect on them [START_REF] Mcadam | Political process and the development of Black insurgency, 1930-1970[END_REF][START_REF] Meyer | Conceptualizing political opportunity[END_REF]). Yet it has rarely been specified why POSs sometimes would, and other times would not, be perceived and acted upon (de Moor and Wahlström 2019). People may learn about changes in the POS through various sources, but to assess whether such changes really constitute an opening or closure of opportunity, one needs to interact with the state and draw conclusions from those experiences (or, as noted by [START_REF] Wall | Mobilising Earth First! in Britain[END_REF], interpret other organizations' interactions with the state). We have argued elsewhere (de Moor and Wahlström 2019) that experiences of such interactions are constructed, retained and transformed into strategies through collective narration in which common conceptions of actors, causal connections and projected developments are constructed. This perspective highlights that when a collective actor decides what conclusions to draw from prior interactions with the state this is not a matter of simple cost-benefit analysis. Other considerations may include what narrative seems most convincing and fits other processes. For instance, narratives about the POS are more likely to affect strategies if they match ongoing processes of collective identity formation.

The relation between environmental movements and the POS

We have so far not focused on environmental movements, but several of the key early contributions to the literature on POS in fact relate to them (e.g. [START_REF] Kitschelt | Political opportunity structures and political protest: Anti-nuclear movements in four democracies[END_REF][START_REF] Rucht | Campaigns, skirmishes and battles: anti-nuclear movements in the USA, France and West Germany[END_REF][START_REF] Kriesi | New Social Movements in Western Europe: A Comparative Analysis[END_REF]. Findings on environmental movements were therefore central to shaping POS theory. In this section we explore these foundational insights in greater detail, while taking into account a number of distinctive features of the relation between the POS and environmental movements.

Historical overview of research on POS and environmental movements

Building on prior work on the impact of political context of other movements, Kitschelt (1986) appears to have been the first to apply an explicit POS perspective on an environmental movementthe anti-nuclear movement in France, Sweden, the US and West Germany. Kitschelt looked at both input and output structures to explain tactical variations between anti-nuclear movements in four countries. Where input structures were open, like in Sweden and the US, strategies focused on using those institutional openings through assimilative strategies like lobbying. By contrast, in closed input structures, like in France and West-Germany, more confrontational outsider strategies like demonstrations and civil disobedience were necessary. In the US, output structures were weak and therefore open to challengers, so activists maintained assimilative strategies even in the output phase of the nuclear policies. By contrast, Swedish 1970s anti-nuclear activists found few opportunities to influence the country's strong output structure.

In direct response to Kitschelt, Rucht (1990) analysed anti-nuclear movements in the same cases (except Sweden), arguing that Kitschelt's POS model was overly simplistic and could not accurately explain strategic variations. While recognizing the value of considering input and output structures to explain more or less assimilative strategies, Rucht argued that "the concept of political opportunity in its present form can only serve as a starting point for a more sophisticated analysis which includes a broader range of explanatory variables " (1990: 218-219). These variables include transnational diffusion of strategies, the effect of sociocultural conditions on the tactical repertoire that activists can draw from, time-specific factors affecting changes in the POS over time, varying perceptions of the same 'objective' POS, and the interpretation of the meaning of a conflict. These considerations have remained influential in debates on POS. [START_REF] Kriesi | New Social Movements in Western Europe: A Comparative Analysis[END_REF] later analysed social movements' politicization of the Chernobyl nuclear disaster in four countries, showing that the exclusive French state disabled successful mobilization, whereas the weak Swiss and German states were more open to mobilization but did not provide the same opportunities for substantive success as the strong and inclusive Dutch state. Similarly, [START_REF] Van Der Heijden | Political opportunity structure and the institutionalisation of the environmental movement[END_REF] studied the institutionalization 1 of environmental movements in France, Germany, the Netherlands, and Switzerland, arguing that differences in degrees of institutionalization were attributable to POS factors such as centralization of the state and degree of repression towards the movement. [START_REF] Rootes | Political Opportunity Structures: promise, problems and prospects[END_REF], in contrast, argued that there is little consistency in the relation between stable features of the political context and environmental movement institutionalization, for instance pointing to the then increasing number of radical environmental groups in Great Britain, previously dominated by large institutionalized organizations.

Continuing the discussion about environmental movement institutionalization, [START_REF] Dryzek | Green states and social movements: environmentalism in the United States[END_REF] published the seminal study Green States and Social Movements, comparing France, Norway, the US and Germany. They were careful to point out the difference in their approach from POS. While their first dimension (inclusiveexclusive) resembles that of input structures, they contrast their second dimension (activepassive) from that of output structures. Where the latter refers to "the state's ability to impose its agenda on society," (Dryzek et al. 2003: 19), the former looks at whether the state takes a pro-active stance on (environmental) issues. In effect, while e.g. France was considered 'strong' by Kitschelt and Kriesi et al., it is 'passive' for Dryzek et al. Still, the authors find common ground with the previous studies when they conclude that inclusive states lead to greater institutionalization, adding the critical note that access does not equate influence, but often rather co-optation.

Reflecting some more conceptual criticisms of POS in the same period (e.g. Goodwin and Jasper 1999; Rootes 1999) several publications from the late 1990s onwards questioned the usefulness of POS. For example, the influential comparative study on Environmental Protest in Europe edited by Rootes (2003) echoed some of the criticisms articulated by [START_REF] Rucht | Campaigns, skirmishes and battles: anti-nuclear movements in the USA, France and West Germany[END_REF].

The study concluded that "Strictly structural factors, political institutional arrangements foremost among them, explain little if any of the variation in the patterns of environmental protest among the seven states we have considered." (Rootes 2003: 22). Instead, "It is the 1 According to [START_REF] Van Der Heijden | Political opportunity structure and the institutionalisation of the environmental movement[END_REF], institutionalization is defined by three processes: (1) organizational growth, (2) internal institutionalization (e.g. professionalization, bureaucratization and centralization), and (3) external institutionalization (the action repertoire of the movement). contingent and conjunctural dimensions of political opportunities rather than the truly structural ones that best explain the patterns we have observed" (Rootes 2003: 23).

Since then, discussions about the use of POS per se [START_REF] Doherty | Tactics, traditions and opportunities: British and French crop-trashing actions in comparative perspective[END_REF], the relevance of variations over time or space [START_REF] Shriver | Cycles of Repression and Tactical Innovation: The Evolution of Environmental Dissidence in Communist Czechoslovakia[END_REF][START_REF] Sarre | Environmental movements in space-time: the Czech and Slovak republics from Stalinism to post-socialism[END_REF], and perceived or objective POSs [START_REF] Saunders | It's not just structural: Social movements are not homogenous responses to structural features, but networks shaped by organisational strategies and status[END_REF]) have continued. For instance, considering the strategic diversity among environmental groups that exist within the single POS of the UK, [START_REF] Saunders | It's not just structural: Social movements are not homogenous responses to structural features, but networks shaped by organisational strategies and status[END_REF] argued that the POS cannot determine strategies per se. However, she did find that the POS affects how groups relate to each other (see also [START_REF] Gregorio | Gaining Access to the State: Political Opportunities and Agency in Forest Activism in Indonesia[END_REF][START_REF] Heikkila | A Comparative View of Advocacy Coalitions: Exploring Shale Development Politics in the United States, Argentina, and China[END_REF]. That is, while those excluded by the POS develop more collaborative strategies to compensate for unfavourable contextual conditions, those included can afford to remain more isolated (see also [START_REF] Poloni-Staudinger | Why cooperate? cooperation among environmental groups in the United Kingdom, France, and Germany[END_REF]). Yet despite these critiques and qualifications, the concept of POSwith all its variationshas continued to inspire research up until the present. We have identified a number of prominent themes and sub-fields that have dominated discussions on environmental movements.

Contemporary comparisonson different geographic levels

While POS is a concept that is mainly applied to democracies, there are also a number of studies that use it to capture the political context for environmental movements in undemocratic contexts. China appears to be the most commonly studied country (Xie and Van der Heijden 2010) but there are also comparative studies of non-democracies. In a comparison of the varying presence of environmental non-governmnental organizations (ENGOs) in 71 autocracies, [START_REF] Böhmelt | Political Opportunity Structures in Dictatorships? Explaining ENGO Existence in Autocratic Regimes[END_REF] proposes regime type as a crucial factor, tying it primarily to the level of repression. He shows that one-party states, due to lower levels of (overt) repression, more often have active ENGOs, compared to especially military regimes and personalist regimes.

In addition to studies comparing the effects of country-level POS on mobilization and strategies, a good number of studies direct attention to sub-national variation. For example, The impact of local POSs on environmental mobilization has in many instances been studied by comparing resistance to infrastructural projects. [START_REF] Carmin | Resources, opportunities and local environmental action in the democratic transition and early consolidation periods in the Czech Republic[END_REF] found that openings in the POSin terms of elite allies, political representation, divisions among elites and political accessled to higher levels of individual participation against environmental exploitation through building projects. [START_REF] Mcadam | Site Fights": Explaining Opposition to Pipeline Projects in the Developing World[END_REF] compared large infrastructural projects in the 'developing world,' finding that Western funding of the projects and public consultation appeared to be necessary conditions for mobilization, increasing the chance of mobilization when combined with some level of environmental (or other) threat, whereas broader and more stable aspects of the POS on the national level had no discernible impact on the incidence of mobilizations. In apparent contrast, a study of resistance against mining projects in Sweden [START_REF] Zachrisson | Political opportunity and mobilization: The evolution of a Swedish mining-sceptical movement[END_REF] found that movements were mobilized when the state offered little or no access to influencing the decisions about mining projects. Apparently, factors like public consultations can have rather different effects on movements across different contexts.

International political opportunities and the growing importance of output structures

Sticking with questions of levels of government, the environmental movement is one of the movements most profoundly affected by the globalization of politicsas a result of both the nature of the problems it addresses and the international governmental organizations (IGOs) that have emerged in response to them. Graubert (2004) was one of the first to shift attention to the impact of the international level on environmental movement strategies, which was shortly after further developed by [START_REF] Van Der Heijden | Globalization, environmental movements, and international political opportunity structures[END_REF]. Van der Heijden argues that open formal structures and integrative formal elite strategies increases the frequency of NGOs using 'conventional' strategies whereas closed formal structures and exclusive elite strategies increases 'unconventional' protest. Importantly, he points out that the IPOS for different social movements is tied to different international governmental institutions, depending on their jurisdiction and the issues they deal with. Concurrently, [START_REF] Derman | Climate governance, justice, and transnational civil society[END_REF] argued that the relative favourability of the IPOS presented by the UN for working on climate justice can be used to explain transnational climate justice advocacy. [START_REF] Poloni-Staudinger | The Domestic Opportunity Structure and Supranational Activity: An Explanation of Environmental Group Activity at the European Union Level[END_REF] adds that environmentalists' decision to act at the international level should be understood as a function of the national POS as well: the less favourable it is, the more likely groups are to explore opportunities at the transnational level (see also [START_REF] Henry | NGO participation in global governance institutions: international and domestic drivers of engagement[END_REF]. Similarly, Cassegård and colleagues (2017) argued that climate movement strategies should be seen as emerging out of a back-and-forth between acting in national and transnational contexts.

The discussion on IPOSs has also affected how output structures are understood and how central they might be for explaining movement activity. While Kitschelt mainly considered output structures as opportunities to exert influence during the implementation phase of policies, more recent studies on the transnational level (e.g. Van der Heijden 2006; de Moor and Wahlström 2019) have considered output structures in terms of whether a polity is able to get things done, including the fulfilment of protesters' demands. It has been argued that output structures therefore rather determine which actor movements will target, whereas input structures are more decisive for how the polity should be targeted (de Moor 2016). In this light, output structures have arguably become more important to explain the targets of environmental movements given the persistent inability of states to effectively address major environmental concerns like climate change, opening debates about which other, arguably more powerful actors (e.g. companies) should be targeted.

Opportunities changing over time

As the overview so far implies, most studies testing POS theory do so by comparing countries or regions. However, some study the impact of changes in POS over time, either by following long time periods or by studying the impact of major societal transitions. Further emphasizing that there is no obvious positive relationship between open POS and environmental mobilization in the US, a study by [START_REF] Carmichael | Building environmentalism: The Founding of Environmental Movement Organizations in the United States, 1900-2000[END_REF] showed that, between 1900 and 2000 there was even a weak negative relationship between the founding of US environmental organizations and the presence of political allies such as a democratic congress and/or a president sympathetic to the ideas of the movement. A prominent sub-group of diachronic POS studies concern Eastern Europe over the period of its transition to post-socialism. A considerable number of studies have looked at the impact of the collapse of the Soviet-Union on environmentalist strategies, including the shift from organizing collective action to reproducing one's own organizations under hostile conditions in Russia [START_REF] Yanitsky | From nature protection to politics : the Russian environmental movement 1960 -2010[END_REF] and Czechoslovakia [START_REF] Shriver | Cycles of Repression and Tactical Innovation: The Evolution of Environmental Dissidence in Communist Czechoslovakia[END_REF], and the rise of contentious action in response to opportunities opened by a weakening Soviet-Union, followed by institutionalization and internationalization [START_REF] Carmin | Environmental mobilisation and organisations in post-socialist Europe and the former Soviet Union[END_REF].

POS and movement outcomes

Finally, some studies connect POS and environmental movement outcomes (see chapter 30 by Johnson and Agnone for a discussion on outcomes). On the one hand, studies indicate that POSs affect chances for success [START_REF] Rootes | The Impacts of Environmental Movements[END_REF]. For instance, based on a study of anti-nuclear campaigners in China, [START_REF] Sheng | Petitioning and Social Stability in China: Case Studies of Antinuclear Sentiment[END_REF] argues that elite fragmentation and decentralization can increase the number of entry-points for movements and consequently their success (see also [START_REF] Zhang | Allies in action: Institutional actors and grassroots environmental activism[END_REF]. Research on the US has shown the importance of having elite allies in powerparticularly Democratsto ensure the success of environmental campaigning (e.g. [START_REF] Kemberling | When time is on their side: determinants of outcomes in new siting and existing contamination cases in Louisiana[END_REF][START_REF] Giugni | Useless protest? A time-series analysis of the policy outcomes of ecology, antinuclear, and peace movements in the United States, 1977-1995[END_REF]). On the other hand, changes in POSs themselves are often depicted as important movement outcomes in the form of 'structural effects' [START_REF] Kitschelt | Political opportunity structures and political protest: Anti-nuclear movements in four democracies[END_REF]. For instance, [START_REF] Almeida | Political Opportunities and Local Grassroots Environmental Movements: The Case of Minamata[END_REF] argue that a national anti-pollution movement in Japan put pressure on the national government to take pollution into account by challenging its legitimacy in this area, which made it increasingly costly to repress challengers, and which in turn opened up opportunities for local campaigns.

Such structural changes can in turn contribute to substantive movement success [START_REF] Zhang | Allies in action: Institutional actors and grassroots environmental activism[END_REF].

Perceived opportunities

A different comparative approach to comparing the impact of "objective" features in different polities is to compare the strategic consequences of different groups' or individual activists' perceptions of the POS. [START_REF] Ergas | A Model of Sustainable Living: Collective Identity in an Urban Ecovillage[END_REF] demonstrated the importance of perceived opportunities and constraints for shaping how ecovillages pursue their goals. De Moor et al. (2017) similarly argued that perceived opportunitiesoutput structures in particularshape lifestyle activists' choice to engage with the state or not: if the state is perceived as unable to solve environmental problems, they refrain from making demands to it.

While some stress the importance of rational evaluation of political opportunities by which activists learn to 'read' the POS [START_REF] Hadden | The Relational Sources of Advocacy Strategies : Comparative Evidence from the European and US Climate Change Sectors[END_REF], we have as outlined above argued for the importance of interaction and storytelling between groups. In our case study of the climate movement's mobilization around COP21, we found that perceiving the UNFCCC as incapable to get things done motivates disengagement from targeting international climate negotiations (de Moor and Wahlström 2019). However, we challenged the rationalist 'perception model' by stressing the importance of learning about POSs through the experience of interacting with a polity (see also [START_REF] Shriver | Cycles of Repression and Tactical Innovation: The Evolution of Environmental Dissidence in Communist Czechoslovakia[END_REF] and the role of narratives in developing strategies to respond to experienced opportunities or constraints (see also [START_REF] Hadden | Learning from defeat: The strategic reorientation of the U.S. climate movement[END_REF].

POS and the climate movement

Our literature review in the previous section shows the relevance of POS as a concept for studying environmental movements, but perhaps also confirms the challenge in drawing generalizable conclusions from this research. The latter is perhaps not so surprising given the diverse contexts to which POS has been applied and its many different operationalisations. In this final section, we discuss how our two main arguments made so farabout the importance of outputs structures and of movement narrativesapply to the contemporary climate movement. We furthermore use the case to introduce our third and final argument that as movements become less 'instrumental', the POS becomes less central to their strategic considerations. Specifically, we look at the climate movement's historic mobilization around the 2015 Paris Climate Summit (COP21) and the more recent mobilizations by Fridays For Future and Extinction Rebellion.

The Copenhagen narrative and the mobilization around COP21

The 2015 mobilization around COP21was an iconic moment in the history of the climate consequences of COP15 in Copenhagen where movements adopted a strategy of saying: "Yes this is the COP of the last chance," and thought that by massively mobilizing people they could obtain this dream agreement, you know. And then it didn't work. And after that, the climate movement in Europe completely collapsed (…). And so Alternatiba said: "Yes, we need to change this strategy for COP21 and avoid saying it's (…) the COP of the last chance (…)." (Interview Alternatiba 2015) This story clearly emphasizes the contextual dependency of the climate movement's success, and more specifically, how it was constrained by the weakness of the UN's output structure.

Yet while there was broad agreement on this narrative, closer examination showed that it left out conflicting interpretations of what had caused the Copenhagen defeat, instead telling a unified story to identify today's climate movement as having learned from defeat and being on its way to greater success. For instance, some interviewees challenged the idea that everyone had believed that Copenhagen could deliver a great policy victory, instead emphasizing that the climate justice movement itself had failed to develop a strategy that could mobilize sufficiently for its cause, thus understating the role of the POS.

While most of these disagreements remained in the background, one disagreement could not be resolved, creating a deep cleavage within the climate mobilization around COP21. It was in particular the online-based campaign group Avaaz (representing one of the most resourceful groups in the coalition) that strongly disagreed on the accuracy of the narrative, and in particular, on the strategic implications it was attributed. One interviewee explained:

We took Copenhagen as far as we could take it in that moment. (…) And our community was growing massively after Copenhagen. Donating more money than ever before, people were sharing our campaign more than ever before. (…) So, where is the sense of movement collapse coming from? (…) So, we get to Lima [COP20 2014] (…) and there's a presentation from the French groups that the COP is going to be a failure and we have to mobilize at the end of the COP and we shouldn't make it about the COP because we could have the final word and signal to where the movement needs to go next. And we were like, uhm, what?! (Interview AVAAZ

2015)

By disagreeing on the nature and the causes of the Copenhagen failure, Avaaz proposed an alternative narrative. This narrative did not so much challenge the perception of the COP's POS, but instead downplayed its importance by emphasizing the movement's ability to mobilize masses and the strength that lies in that regardless of the POS. This resonates with [START_REF] Gamson | Framing political opportunity[END_REF] argument that POSs are often framed to support pre-existing strategic preferences.

While the coalition that mobilized for COP21 remained intact, this disagreement did lead to a clear split in the strategic plans for COP21 (de Moor 2018). Those adhering to the dominant Copenhagen narrative advocated a strategy that would symbolize the movement's scepticism about the ability of the COP to produce a meaningful outcome. For some this meant mobilizing during the COP but focusing on corporate targets like fossil fuel companies and banks supporting them. Others mobilized at the end of the conference to symbolize that they were not trying to influence its outcome. Those who challenged this narrative argued that it was still useful to target the COP, and that the movement merely had to mobilize enough people to drive up pressure on government leaders to do the right thing. To exert this pressure timely, they would mobilize at the beginning of the summit. The latter strategy was criticized by the former for its short-termism as it arguably prioritized the mobilization of as many participants as possible with an overly optimistic narrative that would inevitably lead to disappointment like in Copenhagen, and subsequently a similar pattern of demobilization. To involve people in climate action for the long term, the dominant belief was that an honest, more sombre presentation of expectations would be more successful. This disagreement crystalized in a split mobilization where those adhering to a story of favourable political opportunities at COP21 mobilized during the first weekend of the summit and those adhering to a story of lacking opportunities mobilized elsewhere or during the last weekend.

Ultimately, these plans were disrupted entirely when France introduced a state of emergency after the 15 November terrorist attacks in Paris just two weeks before the Summit [START_REF] Wahlström | Governing dissent in a state of emergency: Police and protester interactions in the global space of the COP[END_REF], indicating a dramatic and fast closure of opportunities in the form of a demonstration ban. However, the case still shows how narrated perceptions of the POS, and of output structures in particular, affected mobilization and strategy in the climate movement. We believe this case also shows that this version of the POS approach can bridge the structure-agency duality. It is possible to identify actual conditions "out there" that affect the degree of success of a mobilization, but experiences have to be made by the movement in interaction with these conditions, and then interpreted to guide strategy. Different strategies among movement factions do not show the lack of impact of structure; only that it is not deterministic.

FFF and XR: the end of a narrative?

If the Copenhagen narrative motivated a widespread desire to move activism beyond attempts to influence (especially international) policy-making processes, more recent climate mobilizations suggest that this narrative, or at least its impact, has changed. Since late 2018, climate activism has taken a new turn with the emergence of new campaigns in the form of FFF and XR. While the former is mainly characterized by its non-confrontational tactics of school strikes and mass demonstrations, the latter opts for non-violent civil disobedience to disrupt public life and force stronger climate action. Yet they have in common that they primarily target governmental institutionseither at the local and national levels, or at the international level such as during the 2019 Climate Summits in New York and Madrid. This represents a clear break from recent trends towards direct action campaigns like Ende Gelände which in Germany organizes massive occupations of coal mines, to instead focusing on demanding action from state governments.

How can we make sense of this shift, particularly from a POS point of view? Does this shift mean that FFF and XR are more optimistic about the ability of states to get things done, or do they share the scepticism of previous climate movements but draw different strategic conclusions from this? While more research is needed to answer this question in full, some recently collected data indicates that the latter option is a more convincing explanation.

During 2019, we collected protest-survey data at various large-scale FFF and XR demonstrations around the world, giving us representative data on how today's activists perceive states' ability to address environmental issues like climate change (for details on the study see [START_REF] Wahlström | Protest for a future: Composition, mobilization and motives of the participants in Fridays For Future climate protests on 15 March[END_REF][START_REF] De Moor | Protest for a future II: Composition, mobilization and motives of the participants in Fridays For Future climate protests on 20-27 September[END_REF][START_REF] Saunders | A New Climate Movement? Extinction Rebellion's Activists in Profile[END_REF].

The data show widespread scepticism regarding governments' ability to address main environmental challenges, thus indicating that output structures were still perceived to be weak. Specifically, very few respondents agreed with the statement that "governments can be relied upon to solve our environmental problems." As Figure 1.1 shows, this is true across FFF demonstrations in various countries, and comparable data show a very similar picture at XR demonstrations in the UK [START_REF] Saunders | A New Climate Movement? Extinction Rebellion's Activists in Profile[END_REF]. campaigns. While our survey data clearly show that participants in FFF and XR demonstrations have relatively strong instrumental motivations [START_REF] Wahlström | Protest for a future: Composition, mobilization and motives of the participants in Fridays For Future climate protests on 15 March[END_REF][START_REF] De Moor | Protest for a future II: Composition, mobilization and motives of the participants in Fridays For Future climate protests on 20-27 September[END_REF][START_REF] Saunders | A New Climate Movement? Extinction Rebellion's Activists in Profile[END_REF], slogans and messages from within these campaigns also suggest a sense of moral obligation. Between 70 and 80% in most locations of the FFF protest survey agreed or strongly agreed that they participated because "felt morally obliged to do so". Instead of asking which potential target has the greatest capacity and willingness to make things change, governments are addressed based on their moral responsibility to protect the peopletoday and in the futurefrom existential threats posed by climate change. This is for instance illustrated by Greta Thunberg's famous speech at the UN Climate Summit in New York 2019: "People are suffering. People are dying. Entire ecosystems are collapsing. We are at the beginning of a mass extinction and all you can talk about is money and fairy tales of economic growth. How dare you?!"

INSERT FIGURE 1.1 NEAR HERE

The need for citizens to pressure governments into taking up this responsibility is framed in similarly moral terms, as illustrated by an elderly XR protester who was photographed wearing a sign saying, "I am a rebel so that I can look my grandchildren in the eye". In the face of existential crises, instrumental discussions about political opportunities seem to loose force, making room for unconditional demands for actionno matter what the circumstances. A Swedish activist recently explained to us that for XR, "bravery" is a key virtue, referring to the tenacity to keep fighting despite having the odds stacked against you.

Conclusion

The impact of the political context on environmental movements has been a productive field of research for several decades now. Much of the early work in the area was preoccupied with national comparisons of developments of the environmental movement in different countries, in particular different degrees of institutionalization. Lately, focus seems to have increasingly shifted towards both local variations as well as international political opportunity structures. The latter represents the globalized framing of the climate issue and the concomitantly globalized mobilization. The complex governance of this issue has presented challenges for movement actors to accurately identify political opportunities and highlighted the need for studying activists' perceptions of the POS and how those perceptions are translated into movement strategies.

We have sought to make three main contributions to the already rich literature on environmental movements and POS: 1) while input structures have received most attention, output structures seem to merit as much attention -especially in a context in which states' capacity to act on society's main environmental challenges has become questionable; 2) narratives may present a key mechanism to link POS and strategies, and narrated opportunities need to be understood as entangled in wider movement process, including collective identity formation; and 3) the relevance of POS can vary over timeeven within movementsdepending on the instrumental or moral orientation of the movement. Applying these ideas to some of the most recent climate movement mobilizations, we can conclude that new narratives facilitate a re-responsibilizing of the state which may ultimately result in the strengthening of output structures, thus rendering the state's POS more favourable for environmental movements. At the same time, whether and how the POS is relevant to environmental movements remains a question that merits ongoing academic scrutiny.

  McCright and Nichols Clark (2006) compared the impact of varying POSs on environmental mobilization in 257 American communities, finding only weak effects of institutional dimensions of local POS on movement activity level. They instead emphasized the positive mobilizing effects of the activity of other movements and the activity levels of individual citizens, thereby including factors that clearly fall outside of typical definitions and operationalisations of POS.

  movement. In analysing how POSs affected this mobilization, a story of the failed COP15 Copenhagen Summit in 2009 kept recurring in strategic discussions. Copenhagen hadboth inside and outside the climate movementraised great expectations of delivering a crucial step forwards in the global effort to address climate change, but delivered an equally great disappointment when it failed. At least that was the dominant 'Copenhagen narrative'moderated and streamlined to unify the climate movement behind a new strategy. The following example illustrates both the key storyline and its (desired) strategic implications: Interviewer: Do previous experiences with the COP affect how you are mobilizing for COP21? Respondent: Yes, definitely. (…) Alternatiba is actually answering [to] the (…)

Figure 1 . 1

 11 Figure 1.1 Degree of agreement with the statement "governments can be relied upon to solve our environmental problems" among youth and adult participants in Fridays for Future demonstrations 20-27 September 2019. Reproduced under a Creative Commons BY-NC Licence 4.0 from de Moor et al. (2020).

There are considerable variations between countries, but interestingly, there seems to be no direct correlation between 'objective' indicators of environmental performance and these perceptions. While perceived capacity seems to be higher in some countries that are indeed known as environmental leaders (e.g. Sweden, but here we also find considerable internal differences), it is low in other 'leading' countries (e.g. Germany) and relatively high in some laggards (e.g. Hungary) (see [START_REF] Liefferink | Leaders and laggards in environmental policy: a quantitative analysis of domestic policy outputs[END_REF]. What seems to matter more is an overall perception of states as weak on environmental performance.

While we cannot directly compare these quantitative findings to the qualitative findings of our COP21 study, we can cautiously conclude that there has not been a radical shift away from perceiving states' output structures as weak. It is therefore more likely that what has changed is how activists draw strategic conclusions from these perceptions. Here we present some working hypotheses as to what might be going on.

A first possibility is that the capacity of the state to get things done is no longer framed as a given contextual determinant, but as something that social movements can influence.

Previous studies suggested that while social movements may believe that they can force governments to listen, they might not believe they can force them to become more capable (de Moor 2016). However, capacity to act is to some degree the result of political decisions (e.g. the amount of tax a state decides to collect can affect the extent to which it can address societal problems), and movements can and do challenge these decisions. For instance, [START_REF] Thörn | The Swedish environmental movement: Politics of responsibility between climate justice and local transition[END_REF] argue that environmental movements sometimes oppose neoliberal processes by which states shift responsibility to address environmental challenges to market actors and civil society, demanding instead that states take more responsibility themselves.

Such views may contribute to the current re-responsibilizing of the state (see also Thörn's chapter in this volume). In POS terms, we could thus argue that not only input structures can be seen as movement outcomes (see above), but that output structures can be as well. We also see this reflected in the argument expressed by multiple climate activists that states' farreaching actions in response to the Covid-19 pandemic prove thatif willinggovernments could deploy similarly strong measures in response to the climate crisis.

A second possibility is that we are witnessing a shift not so much in how POSs matter for FFF's and XR's strategies, but whether they matter. As discussed earlier, POSs are considered to be especially important for 'instrumental movements,' and changes in this regard may make perceived POSs less relevant to inform strategies in today's climate