KubeArmor
Runtime protection for Kubernetes & other cloud Workloads. Kubearmor provides a observability and policy enforcement system to restrict any unwanted, malicious behaviour of cloud-native workloads at runtime.
Stars
946
Forks
263
Open issues
193
Closed issues
391
Last release
5 months ago
Last commit
5 months ago
Watchers
946
Total releases
25
Total commits
2.82K
Open PRs
59
Closed PRs
792
- Project Website
- https://kubearmor.io/
- Platform
- License
- apache-2.0
- Category
- Usecase
- Provisioning Security & Compliance
- Technology
- MongoDB javascript Shell Dockerfile Makefile HTML
- Offers premium version?
- NO
- Proprietary?
- NO
- About
-
KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level.
KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.
💪 Harden Infrastructure ⛓️ Protect critical paths such as cert bundles
📋 MITRE, STIGs, CIS based rules
🛅 Restrict access to raw DB table 💍 Least Permissive Access 🚥 Process Whitelisting
🚥 Network Whitelisting
🎛️ Control access to sensitive assets🔭 Application Behavior 🧬 Process execs, File System accesses
🧭 Service binds, Ingress, Egress connections
🔬 Sensitive system call profiling ❄️ Deployment Models ☸️ Kubernetes Deployment
🐋 Containerized Deployment
💻 VM/Bare-Metal DeploymentArchitecture Overview
Documentation 📓
- 👉 Getting Started
- 🎯 Use Cases
- ✔️ KubeArmor Support Matrix
- ♟️ How is KubeArmor different?
- 📜 Security Policy for Pods/Containers [Spec] [Examples]
- 📜 Security Policy for Hosts/Nodes [Spec] [Examples]
... detailed documentation
Contributors 👥
Biweekly Meeting
- 🗣️ Zoom Link
- :page_facing_up: Minutes: Document
- :calendar: Calendar invite: Google Calendar, ICS file
Notice/Credits 🤝
- KubeArmor uses Tracee's system call utility functions.
CNCF
KubeArmor is Sandbox Project of the Cloud Native Computing Foundation.
ROADMAP
KubeArmor roadmap is tracked via KubeArmor Projects
Alternative Projects
-
Reference Airship manifests, CICD, and reference architecture.49
-
A Kubernetes Resource Interface for the Edge1.02K
-
Ansible is a radically simple IT automation platform that makes your applications and systems easier to deploy and maintain. Automate everything from code deployment to network configuration to cloud management, in a language that approaches plain English, using SSH, with no agents to install on remote systems. https://docs.ansible.com.59.4K
-
Apollo is a reliable open-source configuration management system28.5K
-
AWS CloudFormation provides a common language for you to describe and provision all the infrastructure resources in your cloud environment.
-
Cloud Foundry BOSH is an open source tool chain for release engineering, deployment and lifecycle management of large scale distributed services.2.01K
-
Cadence is a distributed, scalable, durable, and highly available fault-oblivious stateful code platform.7.46K
-
CDK8s lets you define Kubernetes apps and components using familiar programming languages and object-oriented APIs.3.91K
-
Chef Infra, a powerful automation platform that transforms infrastructure into code automating how infrastructure is configured, deployed and managed across any environment, at any scale7.37K
-
Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources5.04K
-
Unified Interface for Constructing and Managing Workflows on different workflow engines, such as Argo Workflows, Tekton Pipelines, and Apache Airflow.856
-
DevStream: the open-source DevOps toolchain manager (DTM).835
-
Docs, API bindings, clients and integrations supporting RackN Digital Rebar data center provisioning and workflow system.137
-
an application that automates the lifecycle of servers2.45K
-
Universal Operator Lifecycle Manager (OLM) for Kubernetes operators, and operators for traditional Linux apps, with declarative integration between operators for automated microservice integration.2.19K
-
kiosk 🏢 Multi-Tenancy Extension For Kubernetes - Secure Cluster Sharing & Self-Service Namespace Provisioning1.04K
-
Run your deep learning workloads on Kubernetes more easily and efficiently.452
-
Kubernetes Native Edge Computing Framework (project under CNCF)6.17K
-
Kubernetes Platform Provisioning for Application Delivery and Infrastruction Management1.25K
-
a lightweight kubernetes multi-tenancy gateway609
-
Platform Engineering Engine: Deliver intentions to Kubernetes and Clouds664
-
A toolkit for building secure, portable and lean operating systems for containers8K
-
Self-service, remote installation of Windows, CentOS, ESXi and Ubuntu on real servers turns your data center into a bare-metal cloud.295
-
ManageIQ Open-Source Management Platform1.31K
-
CNCF is an open source software foundation that hosts and nurtures projects like Kubernetes and Prometheus.
-
Mist is an open source, multicloud management platform1.81K
-
Repository tracking all OpenStack repositories as submodules. Mirror of code maintained at opendev.org.5.02K
-
An open platform that extending your native Kubernetes to edge.1.59K
-
Pulumi - Universal Infrastructure as Code. Your Cloud, Your Language, Your Way 🚀18.4K
-
Server automation framework and application7.16K
-
Enable Self-Service Operations: Give specific users access to your existing tools, services, and scripts5.14K
-
Software to automate the management and configuration of any infrastructure or application at scale. Get access to the Salt software package repository here:13.6K
-
Shifu is the next generation cloud native IoT development framework that could 10X your IoT software development1.11K
-
An edge-native container management system for edge computing987
-
Terraform enables you to safely and predictably create, change, and improve infrastructure. It is an open source tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.39.6K
-
A workflow engine for provisioning bare metal.833
-
vSphere is the industry-leading server virtualization software and the heart of a modern SDDC, helping you run, manage, connect, and secure your applications in a common operating environment across clouds.
-
Alibaba Cloud Container Registry (ACR) is a cloud-native artifacts management platform that helps your team build, manage, and ship containerized applications, also provides vulnerability analysis, global synchronization, content trust, and more functionalities out of the box.
-
Amazon Elastic Container Registry (ECR) is a fully-managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images.
-
Azure Container Registry allows you to store images for all types of container deployments including DC/OS, Docker Swarm, Kubernetes, and Azure services such as App Service, Batch, Service Fabric, and others.
-
The toolkit to pack, ship, store, and deliver container content8.01K
-
Container Registry is a single place for your team to manage Docker images, perform vulnerability analysis, and decide who can access what with fine-grained access control.
-
An open source trusted cloud native registry project that stores, signs, and scans content.21.3K
-
Detect vulnerabilities before images are ever deployed to containers. Store and distribute Docker images in your managed private registry.
-
Shipping updates continuously and automatically has become a critical element of any successful operation. JFrog is revolutionizing the software world with the practice of Continuous Update, with a speed and continuity that forever changes the way organizations manage and release software.
-
P2P Docker registry capable of distributing TBs of data in seconds5.7K
-
Authorization service and frontend for Docker registry (v2)2.99K
-
Build, Store, and Distribute your Applications and Containers2.29K
-
Zot is an OCI-native container registry for distributing container images and OCI artifacts.569
-
Application security, API Security, Identity and Access Management, 2FA, Security for container environments
-
Alcide provides dev-to-production security for workloads running in Kubernetes & Istio
-
A service that analyzes docker images and scans for vulnerabilities1.56K
-
Apolicy fuses security and compliance into your cloud native development pipeline. Using policy-as-code, we automate risk, policy and remediation from source to production
-
Aqua Security is a software company providing cloud-native security technology.
-
Creators of Kubescape: the first end-to-end open-source Kubernetes Security platform, made for DevOps.
-
Fine-grained, policy-based, real-time authorization for APIs and microservices. Aserto is the maintainer of the Topaz and Open Policy Containers OSS projects.24
-
Black Duck provides a comprehensive software composition analysis (SCA) solution for managing security, quality, and license compliance risk that comes from the use of open source and third-party code in applications and containers.
-
Bloombase is the intelligent storage firewall company
-
High-performance attack protection for Linux production environments – whether containerized, virtualized, or bare-metal, on-prem or cloud
-
Cerbos is the open core, language-agnostic, scalable authorization solution that makes user permissions and authorization simple to implement and manage by writing context-aware access control policies for your application resources.2.1K
-
Automatically provision and manage TLS certificates in Kubernetes10.9K
-
Chaitin Tech is a world leading and technology driven cyber security solution provider.
-
Check Point Software Technologies Ltd. is a leading provider of cyber security solutions to corporate enterprises and governments globally. Check Point protects over 100,000 organizations of all sizes.
-
Checkov scans cloud infrastructure configurations to find misconfigurations before they are deployed. Checkov manages and analyzes infrastructure as code (IaC) scan results across platforms such as Terraform, CloudFormation, Kubernetes, Helm, ARM Templates and Serverless framework.6.15K
-
Vulnerability Static Analysis for Containers9.82K
-
Pioneering the world of self-healing, self-aware, self-sustaining, self-resilient, self-secure and intelligent remediation, MatosSphere brings a complete cloud security and governance solution for your cloud infrastructure.12
-
Confidential Containers is an open source community working to enable cloud native confidential computing by leveraging Trusted Execution Environments to protect containers and data.74
-
ContainerSSH launches a new container for each SSH connection in Kubernetes, Podman or Docker. The user is transparently dropped in the container and the container is removed when the user disconnects. Authentication and container configuration are dynamic using webhooks, no system users required.2.47K
-
Curiefense is a unified, open source platform protecting cloud native applications.689
-
Datica brings the cloud to healthcare and helps highly regulated industries.
-
Prevent Kubernetes misconfigurations from reaching production (again 😤 )! From code to cloud, Datree provides an E2E policy enforcement solution to run automatic checks for rule violations. See our docs: https://hub.datree.io6.37K
-
OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors8.62K
-
Dosec Security Platform provides security protection capabilities for containers, kubernetes, microservices, serverless, and DevOps.
-
External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets.3.32K
-
Kubernetes security, policy and compliance experts
-
Fast, portable and reliable dependency analysis for any codebase. Supports license & vulnerability scanning for large monoliths. Language-agnostic; integrates with 20+ build systems.1.18K
-
FossID is a software composition analysis tool that scans code for open source licenses and vulnerabilities.
-
Fugue empowers cloud engineering and security teams to move faster with confidence in their cloud security. Use Fugue to secure the entire development lifecycle—from infrastructure as code through CI/CD and runtime—using a unified policy engine powered by the Open Policy Agent (OPA), the open source standard for policy as code.
-
Get your resource requests "Just Right"2.12K
-
Hexa Policy Orchestrator enables you to manage all of your access policies consistently across software providers.79
-
in-toto is a framework to protect supply chain integrity.786
-
Bootstrap & Maintain Trust on the Edge / Cloud and IoT.362
-
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.1.77K
-
Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark6.34K
-
Hunt for security weaknesses in Kubernetes clusters4.5K
-
Kubescape is an open source security and compliance platform that scans clusters, Kubernetes manifest files (YAML files, and Helm charts), code repositories, container registries and images. It detects misconfigurations according to frameworks such as the NSA-CISA, MITRE ATT&CK® and CIS, as well as software vulnerabilities, and calculates risk scores.9.3K
-
Manage admission policies in your Kubernetes cluster with ease157
-
Metarget is a framework providing automatic constructions of vulnerable cloud native infrastructures.930
-
Cloud native infrastructure security for your entire fleet
-
Moresec Shangfu Cloud Native Protection Platform is a security protection model based on the concept of cloud native. In view of the characteristics of cloud native application life-cycle, it involves in many stages of security protection, including R&D construction, security testing, image control, container deployment, container operation, etc. Shangfu also integrates security with development which means providing feedback of the application security condition through correlating operation asset, and promoting the iteration and upgrade of application. Whereupon, a closed loop of efficient cloud native application security risk is created, covering the whole stages of DevSecOps.
-
NeuVector Full Lifecycle Container Security Platform delivers the only cloud-native security with uncompromising end-to-end protection from DevOps vulnerability protection to automated run-time security, and featuring a true Layer 7 container firewall.906
-
The solution enables DevSecOps teams to ensure the security, compliance, and operational readiness of their Kubernetes workloads and clusters. By automating the creation, deployment, and lifecycle management of policy-based Intelligent Guardrails, customers can gain insights, alerts, and reports, and enable effective collaboration across development and operations teams.
-
Notary is a project that allows anyone to have trust over arbitrary collections of data3.12K
-
An open source, general-purpose policy engine.8.7K
-
A docker-inspired CLI for building, tagging, pushing, pulling, and signing OPA policies to and from OCI-compliant registries.184
-
OpenFGA is a high performance and flexible authorization/permission system built for developers and inspired by Google Zanzibar1.7K
-
Orca Security provides instant-on, workload-level security for AWS, Microsoft Azure, and Google Cloud Platform.
-
Noise Cancellation for Application Security. Built for cloud-native applications using container and Kubernetes-based architectures.
-
Open source, Security-as-Code platform for developers and security teams to identify and eliminate risks in your clouds.
-
Paralus is a free, open source tool that enables controlled, audited access to Kubernetes infrastructure and Zero trust Kubernetes with zero friction.856
-
Passage makes it easy for developers to implement passwordless customer identity in any application.
-
A cli tool to help discover deprecated apiVersions in Kubernetes1.81K
-
Validation of best practices in your Kubernetes clusters3.01K
-
Kubernetes-native security solution, single pane of glass for containers and Kubernetes security.
-
A complete cloud native application protection platform that secures infrastructure and applications across cloud environments.
-
Qingteng Honeycomb · Container Security Platform can display risk scenarios visually for enterprises through continuous monitoring and analysis of the container security status, and protects the container environment during the entire life cycle (build, ship, and run) of the container.
-
Easily find roles and cluster roles attached to any user, service account, or group name in your Kubernetes cluster794
-
A Kubernetes operator that simplifies the management of Role Bindings and Service Accounts.1.35K
-
Rudder is a configuration and security automation platform. Manage your Cloud, hybrid or on-premises infrastructure in a simple, scalable and dynamic way.472
-
Scribe Security is a Tel Aviv, Israel-based provider of a SaaS platform for securing software across various supply chains.
-
Common go library shared across sigstore services and clients409
-
Snyk is a cloud native application security provider that enables millions of developers to build software securely.
-
Sonobuoy is a diagnostic tool that makes it easier to understand the state of a Kubernetes cluster by running a set of Kubernetes conformance tests and other plugins in an accessible and non-destructive manner.2.8K
-
Spyderbat provides Linux runtime security, protecting dynamic environments by proactively tracking all user activities by their causal connections to detect and resolve external attacks, misconfigurations, and insider threats.
-
StackHawk helps developers find and fix application security vulnerabilities before they hit production with CI/CD automation.
-
StackRox is a Kubernetes-native security platform for cloud-native applications, containers, serverless, and Kubernetes.
-
Sysdig Secure embeds security and compliance into the build, run and respond stages of the Kubernetes lifecycle.
-
Tensor Security is a cloud-native security company focused on providing AI-based and full-stack cloud-native security solutions.
-
Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.4.32K
-
eBPF-based Security Observability and Runtime Enforcement2.95K
-
Python reference implementation of The Update Framework (TUF)1.56K
-
Open source cloud native security observability platform. Linux, K8s, AWS Fargate and more.4.51K
-
Active, zero-trust based security for containers and Kubernetes
-
Cloud-native authorization for modern applications and APIs, combining the best of Open Policy Agent and Google Zanzibar888
-
Trend Micro, a global technology leader, helps make the world safe for exchanging digital information with its innovative security platform.
-
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more19.6K
-
Trivy-Operator operate trivy security tool on the Kubernetes cluster and incorporate it outputs into Kubernetes CRDs (Custom Resource Definitions) and from there, making security reports accessible through the Kubernetes API805
-
Mend is a platform designed to automate open source security and compliance processes.
-
Zettaset is software-defined encryption that protects against data theft and can be deployed across all physical and virtual environments.
-
Open source platform for X.509 certificate based service authentication and fine grained access control in dynamic infrastructures816
-
🔥Authing - IDaaS/IAM solution that can Auth to web and mobile applications.987
-
CyberArk Conjur automatically secures secrets used by privileged users and machine identities690
-
A reverse proxy that provides authentication with Google, Azure, OpenID Connect and many more identity providers.7.88K
-
OpenID Certified™ OpenID Connect and OAuth Provider written in Go - cloud native, security-first, open source API security for your infrastructure. SDKs for any language. Works with Hardware Security Modules. Compatible with MITREid.14.6K
-
Pinniped is the easy, secure way to log in to your Kubernetes clusters.482
-
Pomerium is an identity and context-aware access proxy.3.72K
-
A system for distributing and managing secrets2.62K
-
sso, aka S.S.Octopus, aka octoboi, is a single sign-on solution for securing internal services3.04K
-
The easiest, most secure way to access infrastructure.15.5K
-
Cloud native secrets management for developers - never leave your command line for secrets.1.91K
-
A tool for secrets management, encryption as a service, and privileged access management29K
Subscribe to Open Source Businees Newsletter
Twice a month we will interview people behind open source businesses. We will talk about how they are building a business on top of open source projects.
We'll never share your email with anyone else.