KubeArmor
Last updated
Last updated
KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level.
KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.
βοΈ Protect critical paths such as cert bundles π MITRE, STIGs, CIS based rules π Restrict access to raw DB table | π₯ Process Whitelisting π₯ Network Whitelisting ποΈ Control access to sensitive assets |
π Application Behavior 𧬠Process execs, File System accesses π§ Service binds, Ingress, Egress connections π¬ Sensitive system call profiling | βοΈ Deployment Models βΈοΈ Kubernetes Deployment π Containerized Deployment π» VM/Bare-Metal Deployment |
π Getting Started
π― Use Cases
βοΈ KubeArmor Support Matrix
βοΈ How is KubeArmor different?
π Security Policy for Hosts/Nodes [Spec] [Examples] ... detailed documentation
π Contribution Guide
π§βπ» Development Guide, Testing Guide
β FAQs
π£οΈ Zoom Link
π Minutes: Document
π Calendar invite: Google Calendar, ICS file
KubeArmor uses Tracee's system call utility functions.
KubeArmor roadmap is tracked via KubeArmor Projects
KubeArmor is Sandbox Project of the Cloud Native Computing Foundation.