Skip to content

Cloud-native Runtime Security Enforcement System. [CNCF Sandbox Project]

License

Notifications You must be signed in to change notification settings

TnGadaria/KubeArmor

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 Cannot retrieve latest commit at this time.
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Build Status CII Best Practices CLOMonitor OpenSSF Scorecard FOSSA Status FOSSA Status Slack Discussions Docker Downloads ArtifactHub

KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level.

KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.

πŸ’ͺ Harden Infrastructure
⛓️ Protect critical paths such as cert bundles
πŸ“‹ MITRE, STIGs, CIS based rules
πŸ›… Restrict access to raw DB table
πŸ’ Least Permissive Access
πŸš₯ Process Whitelisting
πŸš₯ Network Whitelisting
πŸŽ›οΈ Control access to sensitive assets
πŸ”­ Application Behavior
🧬 Process execs, File System accesses
🧭 Service binds, Ingress, Egress connections
πŸ”¬ Sensitive system call profiling
❄️ Deployment Models
☸️ Kubernetes Deployment
πŸ‹ Containerized Deployment
πŸ’» VM/Bare-Metal Deployment

Architecture Overview

KubeArmor High Level Design

Documentation πŸ““

Contributors πŸ‘₯

Biweekly Meeting

Notice/Credits 🀝

  • KubeArmor uses Tracee's system call utility functions.

CNCF

KubeArmor is Sandbox Project of the Cloud Native Computing Foundation. CNCF SandBox Project

ROADMAP

KubeArmor roadmap is tracked via KubeArmor Projects

About

Cloud-native Runtime Security Enforcement System. [CNCF Sandbox Project]

Resources

License

Code of conduct

Security policy

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Go 75.0%
  • Shell 11.1%
  • C 7.1%
  • HTML 4.0%
  • Makefile 2.2%
  • Dockerfile 0.6%