github.com/kubearmor/KubeArmor @v1.7.4 sqlite

KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level.

KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.

:muscle: Harden Infrastructure :chains: Protect critical paths such as cert bundles

:clipboard: MITRE, STIGs, CIS based rules

:left_luggage: Restrict access to raw DB table | :ring: Least Permissive Access

---

:traffic_light: Process Whitelisting

:traffic_light: Network Whitelisting

:control_knobs: Control access to sensitive assets | | :telescope: Application Behavior

---

:dna: Process execs, File System accesses

:compass: Service binds, Ingress, Egress connections

:microscope: Sensitive system call profiling | :snowflake: Deployment Models

---

:wheel_of_dharma: Kubernetes Deployment

:whale2: Containerized Deployment

:computer: VM/Bare-Metal Deployment |

Architecture Overview

Documentation :notebook:

• :point_right: Getting Started
• :dart: Use Cases
• :heavy_check_mark: KubeArmor Support Matrix
• :chess_pawn: How is KubeArmor different?
• :scroll: Security Policy for Pods/Containers [Spec] [Examples]
• :scroll: Cluster level security Policy for Pods/Containers [Spec] [Examples]
• :scroll: Security Policy for Hosts/Nodes [Spec] [Examples]
• :scroll: Network Security Policy for Hosts/Nodes [Spec] [Examples]

... detailed documentation

Contributors :busts_in_silhouette:

• :blue_book: Contribution Guide
• :technologist: Development Guide, Testing Guide
• :raised_hand: Join KubeArmor Slack
• :question: FAQs

Biweekly Meeting

• :speaking_head: Zoom Link
• :page_facing_up: Minutes: Document
• :calendar: Calendar invite: Google Calendar, ICS file

Community & Governance

KubeArmor is a community-governed project. The following documents describe how the project is run:

• :scroll: Governance — roles, decision-making, vendor neutrality, sub-teams, voting.
• :busts_in_silhouette: Maintainers — current Maintainers, Reviewers, and Emeritus Maintainers, with affiliations.
• :handshake: Code of Conduct — we follow the CNCF Code of Conduct.
• :package: Release Process — cadence, release candidates, release manager, support window.
• :lock: Security Policy — how to report a vulnerability.

Notice/Credits :handshake:

• KubeArmor uses Tracee's system call utility functions.

CNCF

KubeArmor is Sandbox Project of the Cloud Native Computing Foundation.

ROADMAP

KubeArmor roadmap is tracked via KubeArmor Projects

Related Repositories

KubeArmor is more than a single repository. The following repositories under the kubearmor GitHub organization are part of the wider project. Each is governed under GOVERNANCE.md — see the Subprojects section there for how core and community subprojects are classified.

Note: This list covers actively maintained repositories. For the complete (including archived) list, see the organization page.

Core

Repository	What it is
KubeArmor	The main runtime security enforcement daemon. This repository.
kubearmor-client	karmor, the official command-line tool for installing, configuring, and observing KubeArmor.
charts	Official Helm charts for KubeArmor and the KubeArmor Operator.
policy-templates	Community-curated library of System and Network policy templates for KubeArmor (and Cilium).
kubearmor.io	Source for the kubearmor.io website.
.project	Project metadata for CNCF .project automation (CLOMonitor, landscape, etc.).

Integrations and adapters

Repository	What it is
otel-adapter	OpenTelemetry receiver for KubeArmor events and alerts.
kubearmor-prometheus-exporter	Prometheus exporter for KubeArmor metrics.
kubearmor-relay-server	Relay/log streaming server that aggregates events from KubeArmor agents.
kubearmor-kafka-client	Kafka client for streaming KubeArmor logs to a Kafka cluster.
kubearmor-log-client	Standalone log client (stdout or file) for consuming KubeArmor logs.
grafana-datasource	Grafana data source backend for visualising KubeArmor data.
kubearmor-dashboards	ELK-stack dashboards for KubeArmor logs and alerts.
kubearmor-action	GitHub Action that runs KubeArmor against a workload for CI security checks.
rancherui	Rancher Manager UI extension for managing KubeArmor through Rancher.
sidekick	Glue to connect KubeArmor events into downstream ecosystems.

Deployment and packaging

Repository	What it is
custom-packages	Custom .deb / .rpm packaging definitions.
packer-plugin-kubearmor	HashiCorp Packer plugin for baking KubeArmor into images.

Specialised projects

Repository	What it is
k8tls	(Pronounced cattles) — assesses server port security by detecting TLS and certificate configuration.
modelarmor	ML model security, including pickle-injection PoC and adversarial-attack demos.
kvm-service	Service for orchestrating KubeArmor policies to VMs and bare-metal hosts via either a Kubernetes or non-Kubernetes control plane.
libbpf	Go eBPF helper library based on the upstream libbpf API.
kbc	KubeArmor Benchmark Calculator.

This list is generated iteratively — open a pull request to add a new repository or correct a description.