KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level.

KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.

πŸ’ͺ Harden Infrastructure

⛓️ Protect critical paths such as cert bundles

πŸ“‹ MITRE, STIGs, CIS based rules

πŸ›… Restrict access to raw DB table

πŸ’Least Permissive Access

πŸš₯ Process Whitelisting

πŸš₯ Network Whitelisting

πŸŽ›οΈ Control access to sensitive assets

πŸ”­ Application Behavior

🧬 Process execs, File System accesses

🧭 Service binds, Ingress, Egress connections

πŸ”¬ Sensitive system call profiling

❄️ Deployment Models

☸️ Kubernetes Deployment

πŸ‹ Containerized Deployment

πŸ’» VM/Bare-Metal Deployment

Creating an App using the Control Panel

Click the Deploy to DigitalOcean button to install a Kubernetes 1-Click Application. If you aren’t logged in, this link will prompt you to log in with your DigitalOcean account.

Deploy to DO

Creating an App using the API

In addition to creating KubeArmor using the control panel, you can also use the DigitalOcean API. As an example, to create a 3 node DigitalOcean Kubernetes cluster made up of Basic Droplets in the SFO2 region, you can use the following doctl command. You need to authenticate with doctl with your API access token) and replace the $CLUSTER_NAME variable with the chosen name for your cluster in the command below.

doctl kubernetes clusters create --size s-4vcpu-8gb $CLUSTER_NAME --1-clicks kubearmor-operator

Getting Started After Deploying KubeArmor

After Deploying see the details on how to utilize your KubeArmor app, you can read more at https://github.com/kubearmor/KubeArmor/blob/main/getting-started/deployment_guide.md.

Refer to https://kubearmor.io/ for more information, join slack channel for support