zoom_in Click to enlarge

Kubearmor

▲ ▼

language

description Kubearmor Overview

KubeArmor is an open-source container runtime security enforcement system designed specifically for Kubernetes and cloud-native environments. It allows system administrators to define and enforce security policies that restrict unintended or malicious container behaviors. By leveraging Linux security modules like AppArmor and eBPF, the platform provides granular visibility and policy-driven controls to protect applications running within containers.

help Kubearmor FAQ

What can KubeArmor block inside a Kubernetes workload?

KubeArmor can restrict process execution, file access, network activity, service binding, and sensitive system operations. Policies can target pods, containers, namespaces, or nodes.

How does KubeArmor enforce runtime security policies?

It uses Linux Security Modules such as AppArmor, SELinux, or BPF-LSM to enforce policy at the operating-system level. It also uses eBPF to generate alerts and telemetry with Kubernetes identities.

What are KubeArmor KSP, HSP, and CSP policies?

They are Kubernetes-native policy resources used to describe security rules at different scopes. KSP is associated with Kubernetes workloads, HSP with host protection, and CSP with broader cluster-level controls.

Is KubeArmor the same thing as Kubernetes NetworkPolicy?

No. Kubernetes NetworkPolicy focuses mainly on network connectivity, while KubeArmor can control processes, files, system calls, and network operations at runtime.

swap_horiz

Looking for Kubearmor alternatives? Compare top competitors ranked & scored

arrow_forward