KubeArmor
Search…
Getting Started
Contribution
Reference
Deployment Guide
Deployment Steps
1. Download and install karmor cli-tool
1
curl -sfL http://get.kubearmor.io/ | sudo sh -s -- -b /usr/local/bin
Copied!
2. Install KubeArmor
1
karmor install
Copied!
Output of karmor install
It is assumed that the k8s cluster is already present/reachable setup with the required prerequisites and the user has rights to create service-accounts and cluster-role-bindings.
3. Deploying sample app and policies
1
kubectl apply -f https://raw.githubusercontent.com/kubearmor/KubeArmor/main/examples/multiubuntu/multiubuntu-deployment.yaml
Copied!
1
kubectl apply -f https://raw.githubusercontent.com/kubearmor/KubeArmor/main/examples/multiubuntu/security-policies/ksp-group-1-proc-path-block.yaml
Copied!
This sample policy blocks execution of
sleep command in ubuntu-1 pods.c. Simulate policy violation
1
$ POD_NAME=$(kubectl get pods -n multiubuntu -l "group=group-1,container=ubuntu-1" -o jsonpath='{.items[0].metadata.name}') && kubectl -n multiubuntu exec -it $POD_NAME -- bash
2
# sleep 1
3
(Permission Denied)
Copied!
4. Getting Alerts/Telemetry from KubeArmor
a. Enable port-forwarding for KubeArmor relay (if needed)
1
kubectl port-forward -n kube-system svc/kubearmor 32767:32767
Copied!
b. Observing logs using karmor cli
1
karmor log
Copied!
NOTE
- "docker": KubeArmor deployment for self-managed k8s with docker (v18.09 and below).
- "generic": KubeArmor deployment for self-managed k8s with containerd and docker (v18.09 and above).
K8s platforms tested
- 1.Self-managed (on-prem) k8s
- 2.Local k8s engines (k3s, microk8s, and minikube)
- 3.Google Kubernetes Engine (GKE) with Container Optimized OS (COS)
- 4.GKE with Ubuntu image
Prerequisites
- 1.
- 2.
- 3.
- 4.