All Projects → kubearmor → KubeArmor

kubearmor / KubeArmor

Licence: Apache-2.0 license
Cloud-native Runtime Security Enforcement System

Programming Languages

go
31211 projects - #10 most used programming language
shell
77523 projects
c
50402 projects - #5 most used programming language
Makefile
30231 projects
Dockerfile
14818 projects

Projects that are alternatives of or similar to KubeArmor

bpflock
bpflock - eBPF driven security for locking and auditing Linux machines
Stars: ✭ 54 (-87.56%)
Mutual labels:  kernel, ebpf, bpf, lsm
Cilium
eBPF-based Networking, Security, and Observability
Stars: ✭ 10,256 (+2263.13%)
Mutual labels:  kernel, ebpf, bpf
pwru
Packet, where are you? -- Linux kernel networking debugger
Stars: ✭ 694 (+59.91%)
Mutual labels:  kernel, ebpf, bpf
oxdpus
A toy tool that leverages the super powers of XDP to bring in-kernel IP filtering
Stars: ✭ 59 (-86.41%)
Mutual labels:  kernel, ebpf, bpf
Bpfd
Framework for running BPF programs with rules on Linux as a daemon. Container aware.
Stars: ✭ 396 (-8.76%)
Mutual labels:  kernel, ebpf, bpf
disfetch
Yet another *nix distro fetching program, but less complex.
Stars: ✭ 45 (-89.63%)
Mutual labels:  kernel, system
Xdp Project
XDP project collaboration through a git-repo
Stars: ✭ 127 (-70.74%)
Mutual labels:  ebpf, bpf
btfhub
BTFHub, together with BTFHub Archive repository, provides BTF files for existing published kernels that don't support embedded BTF.
Stars: ✭ 100 (-76.96%)
Mutual labels:  kernel, ebpf
Tcpdog
eBPF based TCP observability.
Stars: ✭ 119 (-72.58%)
Mutual labels:  ebpf, bpf
meetup
Cat System Workshop is a regular meet-up focusing on “system software”. We would like to gather all developers to share their experience regarding system software and learn from each other, making system software more perfect and complete!
Stars: ✭ 52 (-88.02%)
Mutual labels:  kernel, system
U Root
A fully Go userland with Linux bootloaders! u-root can create a one-binary root file system (initramfs) containing a busybox-like set of tools written in Go.
Stars: ✭ 1,816 (+318.43%)
Mutual labels:  kernel, system
Polycube
eBPF/XDP-based software framework for fast network services running in the Linux kernel.
Stars: ✭ 217 (-50%)
Mutual labels:  ebpf, bpf
libbpf-sys
Rust bindings to libbpf from the Linux kernel
Stars: ✭ 103 (-76.27%)
Mutual labels:  ebpf, bpf
Mollenos
MollenOS/Vali is a modern operating system that is built with focus on abstraction and a modular design, allowing anyone to port it to any architecture. It currently targets the x86-32 and x86-64 platform.
Stars: ✭ 182 (-58.06%)
Mutual labels:  kernel, system
portablebpf
You came here so you could have a base code to serve you as an example on how to develop a BPF application, compatible to BCC and/or LIBBPF, specially LIBBPF, having the userland part made in C or PYTHON.
Stars: ✭ 32 (-92.63%)
Mutual labels:  ebpf, bpf
ebpf
eBPF package for Go
Stars: ✭ 25 (-94.24%)
Mutual labels:  ebpf, bpf
Kubectl Trace
Schedule bpftrace programs on your kubernetes cluster using the kubectl
Stars: ✭ 1,194 (+175.12%)
Mutual labels:  ebpf, bpf
Libbpf Rs
Minimal and opinionated eBPF tooling for the Rust ecosystem
Stars: ✭ 116 (-73.27%)
Mutual labels:  ebpf, bpf
Mbp Fedora
Stars: ✭ 129 (-70.28%)
Mutual labels:  kernel, system
ebpfault
A BPF-based syscall fault injector
Stars: ✭ 65 (-85.02%)
Mutual labels:  ebpf, bpf

KubeArmor

KubeArmor Logo

Introduction to KubeArmor

Build Status Slack Discussions

KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operation) of containers and nodes (VMs) at the system level.

KubeArmor operates with Linux security modules (LSMs), meaning that it can work on top of any Linux platforms (such as Alpine, Ubuntu, and Container-optimized OS from Google) if Linux security modules (e.g., AppArmor, SELinux, or BPF-LSM) are enabled in the Linux Kernel. KubeArmor will use the appropriate LSMs to enforce the required policies.

KubeArmor allows operators to define security policies and apply them to Kubernetes. Then, KubeArmor will automatically detect the changes in security policies from Kubernetes and enforce them to the corresponding containers and nodes. Also, KubeArmor provides KVMService that allows orchestrating security policies to VMs for non-k8s environments.

If there are any violations against security policies, KubeArmor immediately generates alerts with container identities. If operators have any logging systems, it automatically sends the alerts to their systems as well.

KubeArmor High Level Design

Functionality Overview

  • Restrict the behavior of containers and nodes (VMs) at the system level

    Traditional container security solutions (e.g., Cilium) protect containers by determining their inter-container relations (i.e., service flows) at the network level. In contrast, KubeArmor prevents malicious or unknown behaviors in containers by specifying their desired actions (e.g., a specific process should only be allowed to access a sensitive file). KubeArmor also allows operators to restrict the behaviors of nodes (VMs) based on node identities.

  • Enforce security policies to containers and nodes (VMs) in runtime

    In general, security policies (e.g., Seccomp and AppArmor profiles) are statically defined within pod definitions for Kubernetes, and they are applied to containers at creation time. Then, the security policies are not allowed to be updated in runtime. In addition, there is no way to define security policies for nodes in Kubernetes.

    To address those problems, KubeArmor maintains security policies separately; security policies are no longer tightly coupled with containers. Then, KubeArmor directly applies the security policies into Linux security modules (LSMs) for each container according to the labels of given containers and security policies. Similiarly, KubeArmor directly enforces security policies to nodes (VMs) as well.

  • Produce container-aware alerts and system logs

    LSMs do not have any container-related information; thus, they generate alerts and system logs only based on system metadata (e.g., User ID, Group ID, and process ID). Therefore, it is hard to figure out what containers cause policy violations.

    For this reason, KubeArmor uses an eBPF-based system monitor, which keeps track of process life cycles in containers and even nodes, and converts system metadata to container/node identities when LSMs generate alerts and system logs for any policy violations from containers and nodes (VMs).

  • Provide easy-to-use semantics for policy definitions

    KubeArmor provides the ability to monitor the life cycles of containers' processes and take policy decisions based on them. In general, it is much easier to deny a specific action, but it is more difficult to allow only specific actions while denying all. KubeArmor manages internal complexities associated with handling such policy decisions and provides easy semantics towards policy language.

  • Support network security enforcement among containers

    KubeArmor aims to protect containers and nodes (VMs) themselves rather than inter-container/inter-node communications. However, using KubeArmor a user can add policies that could apply policy settings at the level of network system calls (e.g., bind(), listen(), accept(), and connect()), thus somewhat controlling interactions among containers and nodes (VMs).

Getting Started

Please take a look at the following documents.

  1. Getting Started
  2. Security Policy Specification for Containers
  3. Security Policy Examples for Containers
  4. Security Policy Specification for Nodes (VMs)
  5. Security Policy Examples for Nodes (VMs)

If you want to make a contribution, please refer to the following documents too.

  1. Contribution Guide
  2. Development Guide
  3. Testing Guide

Community

Biweekly Meetup

Slack

Please join the KubeArmor Slack channel to communicate with KubeArmor community. We always welcome having a discussion about the problems that you face during the use of KubeArmor.

License

KubeArmor is licensed under the Apache License, Version 2.0.
The eBPF-based container monitor is licensed under the General Public License, Version 2.0.

Notice/Credits

CNCF

KubeArmor is Sandbox Project of the Cloud Native Computing Foundation CNCF SandBox Project

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].