KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level.

KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.

πŸ’ͺ Harden Infrastructure

⛓️ Protect critical paths such as cert bundles πŸ“‹ MITRE, STIGs, CIS based rules πŸ›… Restrict access to raw DB table

πŸ’ Least Permissive Access

πŸš₯ Process Whitelisting πŸš₯ Network Whitelisting πŸŽ›οΈ Control access to sensitive assets

πŸ”­ Application Behavior

🧬 Process execs, File System accesses 🧭 Service binds, Ingress, Egress connections πŸ”¬ Sensitive system call profiling

❄️ Deployment Models

☸️ Kubernetes Deployment πŸ‹ Containerized Deployment πŸ’» VM/Bare-Metal Deployment

Architecture Overview

KubeArmor High Level Design

Documentation πŸ““

Contributors πŸ‘₯

Biweekly Meeting

Notice/Credits 🀝

  • KubeArmor uses Tracee's system call utility functions.



KubeArmor roadmap is tracked via KubeArmor Projects

Last updated