Skip to content

Commit f6c7aee

Browse files
daemon1024daemon1024
committed
KubeArmor Security Self Assessment
Signed-off-by: daemon1024 <barun1024@gmail.com>
1 parent 779c7ec commit f6c7aee

File tree

3 files changed

+221
-0
lines changed

3 files changed

+221
-0
lines changed

‎community/assessments/projects/kubearmor/README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# KubeArmor Security Assessment
2+
3+
**Project website**: https://kubearmor.io
4+
5+
* [Self-assessment](self-assessment.md)

‎community/assessments/projects/kubearmor/images/kubearmor-arch.png

482 KB
Loading

‎community/assessments/projects/kubearmor/self-assessment.md

Lines changed: 216 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
# KubeArmor Securiy Self-assessment
2+
3+
### Table of contents
4+
5+
- [KubeArmor Securiy Self-assessment](#kubearmor-securiy-self-assessment)
6+
- [Table of contents](#table-of-contents)
7+
- [Metadata](#metadata)
8+
- [Security links](#security-links)
9+
- [Overview](#overview)
10+
- [Background](#background)
11+
- [Architecture](#architecture)
12+
- [Actors](#actors)
13+
- [Actions](#actions)
14+
- [Goals](#goals)
15+
- [Non-goals](#non-goals)
16+
- [Self-assessment use](#self-assessment-use)
17+
- [Security functions and features](#security-functions-and-features)
18+
- [Project compliance](#project-compliance)
19+
- [Secure development practices](#secure-development-practices)
20+
- [Security issue resolution](#security-issue-resolution)
21+
- [Appendix](#appendix)
22+
23+
### Metadata
24+
25+
A table at the top for quick reference information, later used for indexing.
26+
27+
| | |
28+
| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
29+
| Software | <https://github.com/KubeArmor/KubeArmor> |
30+
| Security Provider | Yes |
31+
| Languages | Go, C(eBPF), Shell |
32+
| SBOM | [FOSSA](https://app.fossa.com/projects/git%2Bgithub.com%2Fkubearmor%2FKubeArmor/refs/branch/main/5476d3aa31df7f82c44a69e39eff4298037c9e34/browse/dependencies) |
33+
34+
#### Security links
35+
36+
| Doc | url |
37+
| ------------------------------------ | ----------------------------------------------------------------------------------------------------- |
38+
| Security file | [SECURITY.md](https://github.com/kubearmor/KubeArmor/blob/main/SECURITY.md) |
39+
| Security Considerations in KubeArmor | <https://github.com/kubearmor/KubeArmor/wiki/Security-Considerations-in-KubeArmor> |
40+
| Optional Security Enhancements | <https://github.com/kubearmor/KubeArmor/blob/main/getting-started/kubearmor-security-enhancements.md> |
41+
42+
### Overview
43+
44+
KubeArmor is a runtime Kubernetes security engine. It uses eBPF and Linux Security Modules(LSM) for fortifying workloads based on Cloud Containers, IoT/Edge, and 5G networks. It provides premptive mitagation using policy-based controls.
45+
46+
#### Background
47+
48+
[KubeArmor](https://kubearmor.io/) is a runtime security engine for kubernetes and other cloud workloads. Users can harden their workloads, create Zero Trust security posture i.e., allowing specific systems actions and denying rest using KubeArmor security policies. KubeArmor supports [inline mitigation](https://github.com/kubearmor/KubeArmor/blob/main/getting-started/differentiation.md) for preventing attacks. Due to its versatility, KubeArmor has found its relevance in Edge and 5G Control Plane security scenarios as well.
49+
50+
KubeArmor primarily provides the following key features:
51+
52+
- [Workload Hardening](https://github.com/kubearmor/KubeArmor/blob/main/getting-started/hardening_guide.md)
53+
54+
KubeArmor provides a set of hardening policies that are based on industry-leading compliance and attack frameworks such as CIS, MITRE, NIST-800-53, and STIGs. These policies are designed to help you secure your workloads in a way that is compliant with these frameworks and recommended best practices.
55+
56+
- [Zero Trust Policies](https://github.com/kubearmor/KubeArmor/blob/main/getting-started/least_permissive_access.md)
57+
58+
KubeArmor is a tool that helps organizations enforce a zero trust posture within their Kubernetes clusters. It allows users to define an allow-based policy that specifies the specific system behavior that is allowed, and denies or audits all other behavior.
59+
60+
- [Network Visibility & Microsegmentation](https://github.com/kubearmor/KubeArmor/blob/main/getting-started/network_segmentation.md)
61+
62+
KubeArmor has visibility into the network connections made into or from the pods. It has visibility across socket(), bind(), connect(), accept() calls. KubeArmor can help auto-generate k8s network policy which are enforceable using most of the k8s CNIs (Container Network Interface).
63+
64+
- [Application Behavior](https://github.com/kubearmor/KubeArmor/blob/main/getting-started/workload_visibility.md)
65+
66+
KubeArmor has visibility into systems and application behavior. KubeArmor summarizes/aggregates the information and provides a user-friendly view to figure out the application behavior.
67+
68+
#### Architecture
69+
70+
The following diagram shows the logical architecture for KubeArmor. Each major component is described below:
71+
72+
![KubeArmor Component Architecture](images/kubearmor-arch.png)
73+
74+
![KubeaArmor Architecture](https://github.com/kubearmor/KubeArmor/raw/main/.gitbook/assets/kubearmor_overview.png)
75+
76+
#### Actors
77+
78+
1. **API Server**
79+
- Interacts with various components through CRDs (e.g., `kubearmorconfig` and Policy CRDs).
80+
- Facilitates Namespace Annotations, ConfigMaps, and pod patching operations.
81+
82+
2. **Operator**
83+
- Manages `kubearmorconfig` CRDs and orchestrates changes to the `Daemonset` and Controller components.
84+
85+
3. **Daemonset**
86+
- Runs on **Nodes** and interacts directly with the kernel and CRI API.
87+
- Collects logs and security telemetry for enforcement and analysis.
88+
89+
4. **Controller**
90+
- Responsible for applying patches to pods as part of policy enforcement.
91+
92+
5. **Relay**
93+
- Aggregates logs from `Daemonset` and acts as a communication channel between `Daemonset` and external tools.
94+
95+
6. **kArmor CLI**
96+
- Client-side tool that communicates with the Relay via gRPC to interact with the system.
97+
- Uses helm/client-go for deployments.
98+
99+
7. **Kernel**
100+
- Interfaces with the Daemonset to provide visibility and enforcement capabilities at the system level.
101+
102+
8. **CRI API**
103+
- Exposes container runtime interactions to the Daemonset for policy application and telemetry.
104+
105+
#### Actions
106+
107+
1. **Policy Configuration**
108+
- The API Server interacts with the Operator to manage `kubearmorconfig` CRDs and Policy CRDs.
109+
- Policy changes are propagated to the `Daemonset`, which applies the configuration on the nodes and containers on the respective nodes.
110+
111+
2. **Security Enforcement**
112+
- The Daemonset interacts with the **Kernel** through **Linux Security Moduels** and **eBPF**, **CRI API** to enforce security policies on nodes and containers.
113+
- It can monitor system-level activity, apply runtime restrictions, and collect telemetry logs.
114+
115+
3. **Log Aggregation**
116+
- The Daemonset sends logs and telemetry to the Relay, which aggregates this information for further use.
117+
- These logs can be accessed via the `kArmor CLI`, OpenTelemetry or SIEM Integration for analysis.
118+
119+
4. **Pod Patching**
120+
- The Controller, based on policies and configurations, patches pods as required for setting apparmor annotations.
121+
122+
5. **User Interaction**
123+
- Users interact with the system using the `kArmor CLI` or kubernetes API.
124+
- It communicates via **gRPC** with the Relay Service to fetch logs
125+
- Deployments and runtime configurations are managed using helm or client-go.
126+
127+
6. **Node-Level Enforcement**
128+
- The Daemonset ensures runtime security enforcement at the node level by interacting with the kernel and CRI API.
129+
130+
#### Goals
131+
132+
The goal of the KubeArmor project is to help enforce mandatory access controls and provide observability on processes running inside containers or on host, be it Kubernetes or unorchestrated nodes and containers.
133+
134+
#### Non-goals
135+
136+
KubeArmor is not a general purpose policy engine or a CNI.
137+
138+
### Self-assessment use
139+
140+
This self-assessment is created by the KubeArmor team to perform an internal analysis of the
141+
project's security. It is not intended to provide a security audit of KubeArmor, or
142+
function as an independent assessment or attestation of KubeArmor's security health.
143+
144+
This document serves to provide KubeArmor users with an initial understanding of
145+
KubeArmor's security, where to find existing security documentation, KubeArmor plans for
146+
security, and general overview of KubeArmor security practices, both for development of
147+
KubeArmor as well as security of KubeArmor.
148+
149+
This document provides the CNCF TAG-Security with an initial understanding of KubeArmor
150+
to assist in a joint-assessment, necessary for projects under incubation. Taken
151+
together, this document and the joint-assessment serve as a cornerstone for if and when
152+
KubeArmor seeks graduation and is preparing for a security audit.
153+
154+
### Security functions and features
155+
156+
KubeArmor helps enforce mandatory access control and directly interacts with kernel or apparmor subsystem to help achieve this. KubeArmor directly interacts with privileged entities like eBPF and CRI Socket and we have contained KubeArmor by adequate security measures.
157+
158+
-Threat Modelling
159+
- Accuknox - <https://github.com/accuknox/k8sthreatmodeling/blob/main/models/kubearmor/README.md>
160+
- Independently done by Accuknox Clients
161+
- OSSF Best Practices (Score of 7.9 and Improving)
162+
- Fuzz Testing
163+
- Deployment Best Practices
164+
- Reduced Volume Mountpoints
165+
- Reduced Capabilities
166+
- Component TLS Communication
167+
- Seccomp Profile
168+
- non root containers with supported deployment
169+
- OCI Hooks
170+
- Avoid usage of CRI Sockets
171+
- WIP: Protecting KubeArmor through KubeArmor
172+
173+
### Project compliance
174+
175+
KubeArmor does not document meeting particular compliance standards.
176+
177+
### Secure development practices
178+
179+
- Development Pipeline.
180+
- All code is maintained in [Git](https://github.com/kubearmor/kubearmor/) and changes must be reviewed by atleast 2 maintainers and must pass all unit and e2e tests. Code changes are submitted via Pull Requests (PRs) and must be signed. Commits to the `main` branch are not allowed.
181+
- All code must pass snyk, CodeQL and go-sec scans
182+
183+
- Communication Channels. Reference where you document how to reach your team or
184+
describe in corresponding section.
185+
- Internal: Github Issue, Private Slack Channel and [#kubearmor-dev] on CNCF Slack
186+
- Inbound: [#kubearmor on CNCF Slack](https://cloud-native.slack.com/archives/C02R319HVL3)
187+
- Outbound: [#kubearmor on CNCF Slack](https://cloud-native.slack.com/archives/C02R319HVL3)
188+
189+
- Ecosystem. How does your software fit into the cloud native ecosystem?
190+
- KubeArmor provides a way to enforce security in k8s native way by leveraging k8s resource model.
191+
- KubeArmor has integrations with lots of CNCF and LF Projects including:
192+
- Helm (Installation)
193+
- OpenTelemetry
194+
- OpenHorizon
195+
- Kubernetes PolicyReported CRD
196+
- Nephio
197+
198+
### Security issue resolution
199+
200+
Security Processes are documented in [SECURITY.md](https://github.com/kubearmor/KubeArmor/blob/main/SECURITY.md)
201+
202+
### Appendix
203+
204+
- Known Issues Over Time
205+
- We make sure go-sec and snyk passes before merging any PRs and they run on each commit
206+
- <https://github.com/kubearmor/KubeArmor/actions/workflows/ci-test-go.yml>
207+
- [Open SSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/5401).
208+
- [Open SSF Scorecard](https://securityscorecards.dev/viewer/?uri=github.com/kubearmor/KubeArmor).
209+
- [CLOMonitor](https://clomonitor.io/projects/cncf/kubearmor).
210+
- Case Studies
211+
- [Protecting Secrets Manager like Vault](https://help.accuknox.com/use-cases/hashicorp/?h=vault)
212+
- [Continous Compliance](https://youtu.be/kZ5s9ob1VtE)
213+
- [Virtual Patching](https://youtu.be/FT1FnxsKFxg)
214+
- [AI Security](https://help.accuknox.com/use-cases/modelarmor/)
215+
- Related Projects / Vendors
216+
- We have constant comparisons with Runtime Observability Engines like [Falco](https://github.com/falcosecurity/falco) and Detect and Respond models. We have documented fundamental differences about importance of enforcement, mandatory access control and preemptive mitigation in <https://github.com/kubearmor/KubeArmor/blob/main/getting-started/differentiation.md>

0 commit comments

Comments
 (0)