{"repo":"kubearmor/KubeArmor","free":true,"listed":false,"github":"https://github.com/kubearmor/KubeArmor","clone":"git clone https://github.com/kubearmor/KubeArmor.git","description":"Runtime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (LSM-BPF, AppArmor).","language":"Go","stars":2580,"topics":["lsm","tool","security","containers","kubernetes","policy","system","bpf","ebpf","kernel"],"license":"Apache-2.0","category":"deployment-docker-iac","readme_excerpt":"KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior \\(such as process execution, file access, and networking operations\\) of pods, containers, and nodes (VMs) at the system level. KubeArmor leverages Linux security modules \\(LSMs\\) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF. :--- :--- :muscle: Harden Infrastructure :chains: Protect critical paths such as cert bundles :clipboard: MITRE, STIGs, CIS based rules :left luggage: Restrict access to raw DB table :ring: Least Permissive Access :traffic light: Process Whitelisting :traffic light: Network Whitelisting :control knobs: Control access to sensitive assets :telescope: Application Behavior :dna: Process execs, File System accesses :compass: Service binds, Ingress, Egress connections :microscope: Sensitive system call profiling :snowflake: Deployment Models :wheel of dharma: Kubernetes Deployment :whale2: Containerized Deployment :computer: VM/Bare-Metal Deployment Architecture Overview Documentation :notebook: :point right: Getting Started :dart: Use Cases :heavy check mark: KubeArmor Support Matrix :chess pawn: How is KubeArmor different? :scroll: Security Policy for Pods/Containers [Spec] [Examples] :scroll: Cluster level security Policy for Pods/Containers [Spec] [Examples] :scroll: Security Policy for Hosts/Nodes [Spec] [Examples] :scroll: Ne","default_branch":null,"files":null,"tree":[],"storefront":"/r/kubearmor","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/kubearmor/KubeArmor/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}