KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level.
KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.
Architecture Overview
π
Documentation π Getting Startedπ― Use CasesβοΈ KubeArmor Support Matrixπ How is KubeArmor different?π Security Policy for Pods/Containers [Spec] [Examples]π Security Policy for Hosts/Nodes [Spec] [Examples]
π₯
Contributors - Contribution Guide
π§βπ» Development Guide, Testing GuideπββοΈ Join KubeArmor Slackβ FAQs
Biweekly Meetup
π£οΈ Zoom Linkπ Minutes: Documentπ Calendar invite: Google Calendar, ICS file
π€
Notice/Credits - KubeArmor uses Tracee's system call utility functions.
CNCF
KubeArmor is Sandbox Project of the Cloud Native Computing Foundation.