Overview of KubeArmor
KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of containers and nodes (VMs) at the system level. KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM) to enforce the user-specified policies. KubeArmor generates alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.
KubeArmor installation assumes that a k8s cluster is already set up. It requires Linux kernel version to be greater than 4.14, 2 vCPUs and a minimum of 500MB RAM.
Usage and Examples
• Restrict the behavior of containers and nodes (VMs) at the system level
Traditional container security solutions protect containers by determining their inter-container relations (i.e., service flows) at the network level. In contrast, KubeArmor prevents malicious or unknown behaviors in containers by specifying their desired actions (e.g., a specific process should only be allowed to access a sensitive file). KubeArmor also allows operators to restrict the behaviors of nodes (VMs) based on node identities.
• Enforce security policies to containers and nodes (VMs) at runtime
In general, security policies (e.g., Seccomp and AppArmor profiles) are statically defined within pod definitions for Kubernetes, and they are applied to containers at creation time. Then, the security policies are not allowed to be updated at runtime.
To address those problems, KubeArmor uses k8s CRDs to define security policies, such that the orchestration of the policy is handled by the k8s control plane. KubeArmor leverages Linux Security Modules (LSMs) to enforce the security policies at the container level according to the labels of given containers and security policies. Similarly, KubeArmor supports policy enforcement at the Host/Node/VM level using KubeArmorHostSecurityPolicy k8s resource.
• Produce container-aware alerts and system logs
LSMs do not have any container-related information; thus, they generate alerts and system logs only based on system metadata (e.g., User ID, Group ID, and process ID). It is hard to figure out what containers cause policy violations. KubeArmor uses an eBPF-based system monitor to keep track of process life cycles in containers and even nodes, and converts system metadata to container/node identities when LSMs generate alerts and system logs for any policy violations from containers and nodes (VMs).
• Provide easy-to-use semantics for policy definitions
KubeArmor provides the ability to monitor the life cycles of containers' processes and make policy decisions based on them. In general, it is much easier to deny a specific action, but it is more difficult to allow only specific actions while denying all. KubeArmor manages internal complexities associated with handling such policy decisions and provides easy semantics towards policy language.
• Support network security enforcement among containers
KubeArmor aims to protect containers and nodes (VMs) themselves rather than inter-container/inter-node communications. However, using KubeArmor a user can add policies that could apply policy settings at the level of network system calls (e.g., bind(), listen(), accept(), and connect()), thus controlling interactions among containers and nodes (VMs).
Accuknox Enterprise version provides additional facilities like multi-tenant/multi-cluster management, full GitOps workflow integration and automation, data protection and governance, 3rd party channel integration etc. on top of the existing Open Source Solution. For more details please reach out to us at email@example.com