KubeArmor
KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level.
KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.
Architecture Overview
Documentation π
π Getting Started
π― Use Cases
βοΈ KubeArmor Support Matrix
βοΈ How is KubeArmor different?
π Security Policy for Hosts/Nodes [Spec] [Examples] ... detailed documentation
Contributors π₯
π Contribution Guide
π§βπ» Development Guide, Testing Guide
β FAQs
Biweekly Meeting
π£οΈ Zoom Link
π Minutes: Document
π Calendar invite: Google Calendar, ICS file
Notice/Credits π€
KubeArmor uses Tracee's system call utility functions.
CNCF
ROADMAP
KubeArmor roadmap is tracked via KubeArmor Projects
Last updated