KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level.
KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.
💪
⛓️ Protect critical paths such as cert bundles
📋 MITRE, STIGs, CIS based rules
🛅 Restrict access to raw DB table
Architecture Overview
Documentation 📓
👉
🎯
✔️
Contributors 👥
📘
🧑💻 ,
✋
Biweekly Meeting
🗣️
📄 Minutes:
📆 Calendar invite: ,
Notice/Credits 🤝
KubeArmor uses 's system call utility functions.
CNCF
KubeArmor is of the Cloud Native Computing Foundation.
