{"repo":"dvrkn/ebfw","free":true,"listed":false,"github":"https://github.com/dvrkn/ebfw","clone":"git clone https://github.com/dvrkn/ebfw.git","description":"eBPF egress firewall for Kubernetes — see and enforce what every pod talks to (domains, HTTP paths, headers, IPs), attributed per pod, enforced in the kernel. No sidecar, no proxy, no TLS MITM.","language":"Go","stars":18,"topics":["cgroup","ebpf","egress","firewall","kubernetes","network-policy","observability","security"],"license":"MIT","category":"deployment-docker-iac","readme_excerpt":"ebfw eBPF egress firewall for Kubernetes See exactly what every pod talks to — domains, paths, headers, IPs — then allow or deny it. Attributed per pod. Enforced in the kernel. Install · Configuration · Egress policies · Tests · Roadmap · Images --- ebfw is a single, node-level eBPF agent that shows — and enforces — what every pod on a Kubernetes node is allowed to reach. One cgroup skb program at the node's root cgroup sees every pod's outbound DNS, TLS SNI, HTTP, and new TCP connections; an SSL write uprobe recovers HTTPS request paths before encryption. Every event is attributed to the originating pod ( namespace/name ). The same in-kernel hooks then allow or deny egress per pod by domain / IP / CIDR / port, driven by Kubernetes-native EgressPolicy CRDs. It also sees HTTP paths and headers and lets policy match on method and path (evaluated today; L7 enforcement is on the roadmap). How it works - One cgroup skb/egress program at the node's root cgroup v2 sees egress from every pod on the node — DNS, TLS ClientHello SNI, plaintext HTTP, and new TCP connections — no per-pod sidecar. - An SSL write uprobe reads HTTPS request plaintext before encryption, recovering paths the packet layer can't see. Auto-discovered per container's libssl, live (no sampling). - Attributed per pod in-kernel via the originating cgroup id, enriched to namespace/name by a node-scoped Pods informer. The same maps carry policy verdicts back to the kernel for enforcement. See it Or structured JSON ( EB","default_branch":null,"files":null,"tree":[],"storefront":"/r/dvrkn","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/dvrkn/ebfw/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}