Functionality Overview
KubeArmor provides the following functionality for cloud workloads.

Restrict the behavior of containers and nodes at the system level

Traditional container security solutions (e.g., Cilium) protect containers by determining their inter-container relations (i.e., service flows) at the network level. In contrast, KubeArmor prevents malicious or unknown behaviors in containers by specifying their desired actions (e.g., a specific process should only be allowed to access a sensitive file). KubeArmor also allows operators to restrict the behaviors of nodes based on node identities.

Enforce security policies to containers in runtime

In general, security policies (e.g., Seccomp and AppArmor profiles) are statically defined within pod definitions for Kubernetes, and they are applied to containers at creation time. Then, the security policies are not allowed to be updated in runtime.
To avoid this problem, KubeArmor maintains security policies separately, which means that security policies are no longer tightly coupled with containers. Then, KubeArmor directly applies the security policies into Linux security modules (LSMs) for each container according to the labels of given containers and security policies.

Produce container-aware alerts and system logs

LSMs do not have any container-related information; thus, they generate alerts and system logs only based on system metadata (e.g., User ID, Group ID, and process ID). Therefore, it is hard to figure out what containers cause policy violations.
To address this problem, KubeArmor uses an eBPF-based system monitor, which keeps track of process life cycles in containers, and converts system metadata to container identities when LSMs generate alerts and system logs for any policy violations from containers.

Provide easy-to-use semantics for policy definitions

KubeArmor provides the ability to monitor the life cycles of containers' processes and take policy decisions based on them. In general, it is much easier to deny a specific action but it is more difficult to allow only specific actions while denying all. KubeArmor manages internal complexities associated with handling such policy decisions and provides easy semantics towards policy language.

Support network security enforcement among containers

KubeArmor aims to protect containers themselves rather than interactions among containers. However, using KubeArmor a user can add policies that could apply policy settings at the level of network system calls (e.g., bind(), listen(), accept(), and connect()), thus somewhat controlling interactions among containers.
Last modified 1mo ago
Export as PDF
Copy link