Using the EBPF Superpowers To Generate Kubernetes Security Policies
summary
Shows how eBPF captures real runtime behavior to auto-generate seccomp profiles, Linux capabilities lists and Kubernetes NetworkPolicies using Inspektor Gadget and the Security Profiles Operator (plus oci-seccomp-bpf-hook mentioned). Demonstrations produce JSON seccomp profiles, capability recommendations and per-pod network rules that install and run, and an Inspector Gadget audit stream that detects blocked syscalls. Key limits: coverage gaps if recorded traces miss paths, risk of learning malicious actions, and noisy, overly granular network rules that need human consolidation.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:04K8s Security Policies
- 2:53Generating Security Policies
- 6:52Security Profiles Operator (SPO)
- 7:54Defining Seccomp Profiles
- 16:03Auditing Seccomp Policies
- 21:14Generating Capabilities Security Context
- 24:10The NetworkPolicy Resource
- 24:48Defining Network Policies
- 27:32Auditing Network Policies
- 28:16Limitations
related talks
10mGenerating seccomp policies with eBPF
33mYou and Your Security Profiles; Generating Security Policies with the Help of eBPF
36meBPF for Runtime Security
30mObservability in Kubernetes: Unlocking the Power of eBPF
32mSecuring Kubernetes Applications by Crafting Custom Seccomp Profiles
30mPod Security as an Afterthought
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
43meBPF Superpowers for SRE