Skip to content

Commit 67f85ac

Browse files
daemon1024daemon1024
committed
KubeArmor Security Self Assessment
Signed-off-by: daemon1024 <[email protected]>
1 parent 779c7ec commit 67f85ac

File tree

3 files changed

+222
-0
lines changed

3 files changed

+222
-0
lines changed

‎community/assessments/projects/kubearmor/README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# KubeArmor Security Assessment
2+
3+
**Project website**: <https://kubearmor.io>
4+
5+
* [Self-assessment](self-assessment.md)

‎community/assessments/projects/kubearmor/images/kubearmor-arch.png

482 KB
Loading

‎community/assessments/projects/kubearmor/self-assessment.md

Lines changed: 217 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,217 @@
1+
<!-- cSpell:ignore STIGs kubearmorconfig Accuknox Seccomp kubearmor Falco Nephio SIEM -->
2+
# KubeArmor Security Self-assessment
3+
4+
## Table of contents
5+
6+
- [KubeArmor Security Self-assessment](#kubearmor-security-self-assessment)
7+
- [Table of contents](#table-of-contents)
8+
- [Metadata](#metadata)
9+
- [Security links](#security-links)
10+
- [Overview](#overview)
11+
- [Background](#background)
12+
- [Architecture](#architecture)
13+
- [Actors](#actors)
14+
- [Actions](#actions)
15+
- [Goals](#goals)
16+
- [Non-goals](#non-goals)
17+
- [Self-assessment use](#self-assessment-use)
18+
- [Security functions and features](#security-functions-and-features)
19+
- [Project compliance](#project-compliance)
20+
- [Secure development practices](#secure-development-practices)
21+
- [Security issue resolution](#security-issue-resolution)
22+
- [Appendix](#appendix)
23+
24+
## Metadata
25+
26+
A table at the top for quick reference information, later used for indexing.
27+
28+
| | |
29+
| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
30+
| Software | <https://github.com/KubeArmor/KubeArmor> |
31+
| Security Provider | Yes |
32+
| Languages | Go, C(eBPF), Shell |
33+
| SBOM | [FOSSA](https://app.fossa.com/projects/git%2Bgithub.com%2Fkubearmor%2FKubeArmor/refs/branch/main/5476d3aa31df7f82c44a69e39eff4298037c9e34/browse/dependencies) |
34+
35+
### Security links
36+
37+
| Doc | url |
38+
| ------------------------------------ | ----------------------------------------------------------------------------------------------------- |
39+
| Security file | [SECURITY.md](https://github.com/kubearmor/KubeArmor/blob/main/SECURITY.md) |
40+
| Security Considerations in KubeArmor | <https://github.com/kubearmor/KubeArmor/wiki/Security-Considerations-in-KubeArmor> |
41+
| Optional Security Enhancements | <https://github.com/kubearmor/KubeArmor/blob/main/getting-started/kubearmor-security-enhancements.md> |
42+
43+
## Overview
44+
45+
KubeArmor is a runtime Kubernetes security engine. It uses eBPF and Linux Security Modules(LSM) for fortifying workloads based on Cloud Containers, IoT/Edge, and 5G networks. It provides preemptive mitigation using policy-based controls.
46+
47+
### Background
48+
49+
[KubeArmor](https://kubearmor.io/) is a runtime security engine for kubernetes and other cloud workloads. Users can harden their workloads, create Zero Trust security posture i.e., allowing specific systems actions and denying rest using KubeArmor security policies. KubeArmor supports [inline mitigation](https://github.com/kubearmor/KubeArmor/blob/main/getting-started/differentiation.md) for preventing attacks. Due to its versatility, KubeArmor has found its relevance in [Edge](https://open-horizon.github.io/docs/demos/kubearmor/) and [5G Control Plane security](https://www.5gsec.com/tech/tech-5g-kubearmor) scenarios as well.
50+
51+
KubeArmor primarily provides the following key features:
52+
53+
- [Workload Hardening](https://github.com/kubearmor/KubeArmor/blob/main/getting-started/hardening_guide.md)
54+
55+
KubeArmor provides a set of hardening policies that are based on industry-leading compliance and attack frameworks such as CIS, MITRE, NIST-800-53, and STIGs. These policies are designed to help you secure your workloads in a way that is compliant with these frameworks and recommended best practices.
56+
57+
- [Zero Trust Policies](https://github.com/kubearmor/KubeArmor/blob/main/getting-started/least_permissive_access.md)
58+
59+
KubeArmor is a tool that helps organizations enforce a zero trust posture within their Kubernetes clusters. It allows users to define an allow-based policy that specifies the specific system behavior that is allowed, and denies or audits all other behavior.
60+
61+
- [Network Visibility & Micro-segmentation](https://github.com/kubearmor/KubeArmor/blob/main/getting-started/network_segmentation.md)
62+
63+
KubeArmor has visibility into the network connections made into or from the pods. It has visibility across socket(), bind(), connect(), accept() calls. KubeArmor can help auto-generate k8s network policy which are enforceable using most of the k8s CNIs (Container Network Interface).
64+
65+
- [Application Behavior](https://github.com/kubearmor/KubeArmor/blob/main/getting-started/workload_visibility.md)
66+
67+
KubeArmor has visibility into systems and application behavior. KubeArmor summarizes/aggregates the information and provides a user-friendly view to figure out the application behavior.
68+
69+
### Architecture
70+
71+
The following diagram shows the logical architecture for KubeArmor. Each major component is described below:
72+
73+
![KubeArmor Component Architecture](images/kubearmor-arch.png)
74+
75+
![KubeArmor Architecture](https://github.com/kubearmor/KubeArmor/raw/main/.gitbook/assets/kubearmor_overview.png)
76+
77+
### Actors
78+
79+
1. **API Server**
80+
- Interacts with various components through CRDs (e.g., `kubearmorconfig` and Policy CRDs).
81+
- Facilitates Namespace Annotations, ConfigMaps, and pod patching operations.
82+
83+
2. **Operator**
84+
- Manages `kubearmorconfig` CRDs and orchestrates changes to the `Daemonsets` and Controller components.
85+
86+
3. **Daemonsets**
87+
- Runs on **Nodes** and interacts directly with the kernel and CRI API.
88+
- Collects logs and security telemetry for enforcement and analysis.
89+
90+
4. **Controller**
91+
- Responsible for applying patches to pods as part of policy enforcement.
92+
93+
5. **Relay**
94+
- Aggregates logs from `Daemonsets` and acts as a communication channel between `Daemonsets` and external tools.
95+
96+
6. **kArmor CLI**
97+
- Client-side tool that communicates with the Relay via gRPC to interact with the system.
98+
- Uses helm/client-go for deployments.
99+
100+
7. **Kernel**
101+
- Interfaces with the Daemonsets to provide visibility and enforcement capabilities at the system level.
102+
103+
8. **CRI API**
104+
- Exposes container runtime interactions to the Daemonsets for policy application and telemetry.
105+
106+
### Actions
107+
108+
1. **Policy Configuration**
109+
- The API Server interacts with the Operator to manage `kubearmorconfig` CRDs and Policy CRDs.
110+
- Policy changes are propagated to the `Daemonsets`, which applies the configuration on the nodes and containers on the respective nodes.
111+
112+
2. **Security Enforcement**
113+
- The Daemonsets interacts with the **Kernel** through **Linux Security Modules** and **eBPF**, **CRI API** to enforce security policies on nodes and containers.
114+
- It can monitor system-level activity, apply runtime restrictions, and collect telemetry logs.
115+
116+
3. **Log Aggregation**
117+
- The Daemonsets sends logs and telemetry to the Relay, which aggregates this information for further use.
118+
- These logs can be accessed via the `kArmor CLI`, OpenTelemetry or SIEM Integration for analysis.
119+
120+
4. **Pod Patching**
121+
- The Controller, based on policies and configurations, patches pods as required for setting apparmor annotations.
122+
123+
5. **User Interaction**
124+
- Users interact with the system using the `kArmor CLI` or kubernetes API.
125+
- It communicates via **gRPC** with the Relay Service to fetch logs
126+
- Deployments and runtime configurations are managed using helm or client-go.
127+
128+
6. **Node-Level Enforcement**
129+
- The Daemonsets ensures runtime security enforcement at the node level by interacting with the kernel and CRI API.
130+
131+
### Goals
132+
133+
The goal of the KubeArmor project is to help enforce mandatory access controls and provide observability on processes running inside containers or on host, be it Kubernetes or non orchestrated nodes and containers.
134+
135+
### Non-goals
136+
137+
KubeArmor is not a general purpose policy engine or a CNI.
138+
139+
## Self-assessment use
140+
141+
This self-assessment is created by the KubeArmor team to perform an internal analysis of the
142+
project's security. It is not intended to provide a security audit of KubeArmor, or
143+
function as an independent assessment or attestation of KubeArmor's security health.
144+
145+
This document serves to provide KubeArmor users with an initial understanding of
146+
KubeArmor's security, where to find existing security documentation, KubeArmor plans for
147+
security, and general overview of KubeArmor security practices, both for development of
148+
KubeArmor as well as security of KubeArmor.
149+
150+
This document provides the CNCF TAG-Security with an initial understanding of KubeArmor
151+
to assist in a joint-assessment, necessary for projects under incubation. Taken
152+
together, this document and the joint-assessment serve as a cornerstone for if and when
153+
KubeArmor seeks graduation and is preparing for a security audit.
154+
155+
## Security functions and features
156+
157+
KubeArmor helps enforce mandatory access control and directly interacts with kernel or apparmor subsystem to help achieve this. KubeArmor directly interacts with privileged entities like eBPF and CRI Socket and we have contained KubeArmor by adequate security measures.
158+
159+
-Threat Modelling
160+
- Accuknox - <https://github.com/accuknox/k8sthreatmodeling/blob/main/models/kubearmor/README.md>
161+
- Independently done by Accuknox Clients
162+
- OpenSSF Best Practices (Score of 7.9 and Improving)
163+
- Fuzz Testing
164+
- Deployment Best Practices
165+
- Reduced Volume Mount Points
166+
- Reduced Capabilities
167+
- Component TLS Communication
168+
- Seccomp Profile
169+
- non root containers with supported deployment
170+
- OCI Hooks
171+
- Avoid usage of CRI Sockets
172+
- WIP: Protecting KubeArmor through KubeArmor
173+
174+
## Project compliance
175+
176+
KubeArmor does not document meeting particular compliance standards.
177+
178+
## Secure development practices
179+
180+
- Development Pipeline.
181+
- All code is maintained in [Git](https://github.com/kubearmor/kubearmor/) and changes must be reviewed by atleast 2 maintainers and must pass all unit and e2e tests. Code changes are submitted via Pull Requests (PRs) and must be signed. Commits to the `main` branch are not allowed.
182+
- All code must pass snyk, CodeQL and go-sec scans
183+
184+
- Communication Channels. Reference where you document how to reach your team or
185+
describe in corresponding section.
186+
- Internal: Github Issue, Private Slack Channel and [#kubearmor-dev] on CNCF Slack
187+
- Inbound: [#kubearmor on CNCF Slack](https://cloud-native.slack.com/archives/C02R319HVL3)
188+
- Outbound: [#kubearmor on CNCF Slack](https://cloud-native.slack.com/archives/C02R319HVL3)
189+
190+
- Ecosystem. How does your software fit into the cloud native ecosystem?
191+
- KubeArmor provides a way to enforce security in k8s native way by leveraging k8s resource model.
192+
- KubeArmor has integrations with lots of CNCF and LF Projects including:
193+
- Helm (Installation)
194+
- OpenTelemetry
195+
- OpenHorizon
196+
- Kubernetes PolicyReported CRD
197+
- Nephio
198+
199+
## Security issue resolution
200+
201+
Security Processes are documented in [SECURITY.md](https://github.com/kubearmor/KubeArmor/blob/main/SECURITY.md)
202+
203+
## Appendix
204+
205+
- Known Issues Over Time
206+
- We make sure go-sec and snyk passes before merging any PRs and they run on each commit
207+
- <https://github.com/kubearmor/KubeArmor/actions/workflows/ci-test-go.yml>
208+
- [OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/5401).
209+
- [OpenSSF Scorecard](https://securityscorecards.dev/viewer/?uri=github.com/kubearmor/KubeArmor).
210+
- [CLOMonitor](https://clomonitor.io/projects/cncf/kubearmor).
211+
- Case Studies
212+
- [Protecting Secrets Manager like Vault](https://help.accuknox.com/use-cases/hashicorp/?h=vault)
213+
- [Continuous Compliance](https://youtu.be/kZ5s9ob1VtE)
214+
- [Virtual Patching](https://youtu.be/FT1FnxsKFxg)
215+
- [AI Security](https://help.accuknox.com/use-cases/modelarmor/)
216+
- Related Projects / Vendors
217+
- We have constant comparisons with Runtime Observability Engines like [Falco](https://github.com/falcosecurity/falco) and Detect and Respond models. We have documented fundamental differences about importance of enforcement, mandatory access control and preemptive mitigation in <https://github.com/kubearmor/KubeArmor/blob/main/getting-started/differentiation.md>

0 commit comments

Comments
 (0)