KubeArmor Logo
KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level.
KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.
Protect critical paths such as cert bundles
MITRE, STIGs, CIS based rules :clamp:
Restrict access to raw DB table
Process Whitelisting
Network Whitelisting
Control access to sensitive assets
Communication Graph between services/pods
Generate k8s network policies
Keep policies in sync with app updates
Process execs, File System accesses
Service binds, Ingress, Egress connections
Sensitive system call profiling

Architecture Overview

KubeArmor High Level Design



Biweekly Meetup


  • KubeArmor uses Tracee's system call utility functions.


KubeArmor is Sandbox Project of the Cloud Native Computing Foundation.
CNCF SandBox Project