KubeArmor: Applying Security Policies with Practical Examples in K8S
summary
KubeArmor enforces runtime security policies for Kubernetes using eBPF and AppArmor to monitor and block behavior. The demo deploys a vulnerable web pod, applies a policy that blocks execution of /bin/bash (preventing a bash-based exploit) and shows that sh still works until a matching rule is added. KubeArmor observes syscalls, processes, file and network access, supports major clouds and x86/ARM, and requires knowledge of container contents to lock them down.
AI-written summary · about
chapters (9)
- 0:00KubeArmor intro
- 3:02Kubernetes containers
- 6:09KubeArmor overview
- 7:36Compatibility & OS support
- 9:03Use cases
- 11:31Security policy example
- 15:01KubeArmor demo
- 25:34Monitoring
- 26:18Q&A
related talks
21mArmoring Cloud Native Workloads With LSM Superpowers
34mKAppArmor: Cage Your Pods!
07mLightning Talk: Enhancing Runtime Protection Leveraging Compliance Frameworks
24mRuntime Security: Challenges & Solution Space
25mProtecting Modern Workloads with eBPF superpowers
18mPreventing Bank Heists and AI Takeovers in Kubernetes
34mChoose Your Shield: Evaluating Linux Security Modules for Cloud Na...
31mAutomatic application hardening by leveraging container runtime behavior analysis