Project: KubeArmor (Provisioning / Security & Compliance)
File: KubeArmor Design.pdf

KubeArmor 
Internal Design Agenda 
1.Architectural Overview of KubeArmor 
2.Components in KubeArmor 
a. KubeArmor Core Engine 
b. Platform Handler 
c.LSM Enforcer 
i.AppArmor Enforcer 
ii.SELinux Enforcer 
d. System Monitor 
e. Logger Architectural Overview of KubeArmor KubeArmor 
High-level definition ⇒ Runtime security enforcement system for containers and VMs 
High level point of view Architectural Overview of KubeArmor 
Kubernetes 
Multiple VMs 
(KVM Service) 
Self-managed VM Platform Handler 
(k8s, docker, containerd) 
KVM Agent KubeArmor 
Core Engine AppArmor 
Enforcer 
SELinux 
Enforcer 
System 
Monitor 
Logger 
(Feeder) gRPC Service 
karmor CLI Alerts 
Logs 
KubeArmor Where KubeArmor is? 
Kubernetes Multiple VMs Self-managed VM Node Node VM VM VMKubeArmor KubeArmor 
DaemonSet in Kubernetes KubeArmor KubeArmor KubeArmor 
Systemd daemon in a VM Policies → Kubernetes CR Policies → KVMService Policies → KubeArmor 
Systemd daemon in a VM KVMService karmor CLI KubeArmor Components Component initialization KubeArmor Core Engine 
KubeArmor 
Platform Handler LSM Enforcer Logger System Monitor 
K8s Handler 
Docker Handler 
Containerd Handler AppArmor Enforcer 
SELinux Enforcer gRPC Config 
KVM Agent Platform Handler 
Kubernetes 
Docker 
Containerd Node 
Pod
Security Policy 
Container 
Container 
< Event-driven watcher > NodeName, NodeIP, Labels, Annotations, … 
PodName, Labels, Annotations, Containers, … 
PolicyName, PolicySpec, … 
ContainerName, ContainerID, 
AppArmorProfile, PidNS, MntNS, … 
ContainerName, ContainerID, 
AppArmorProfile, PidNS, MntNS, … 
KVMService Security Policy PolicyName, PolicySpec, … KubeArmor Core Engine 
EndPoint 
Node Name 
Namespace Name 
EndPoint Name 
Labels 
List of Containers 
List of AppArmor Profiles 
List of SELinux Profiles 
List of Security Policies Node 
Pod
Security Policy 
Container KubeUpdate LSM Enforcer LSM Enforcer: AppArmor 
AppArmor → File-based security enforcement 
Security Policy #1 
Security Policy #2 AppArmor Enforcer AppArmor Profile 
AppArmor LSM 
EndPoint LSM Enforcer: SELinux 
SELinux → Label-based security enforcement 
Security Policy #1 
Security Policy #2 SELinux Enforcer 
KubeArmor Profile 
KubeArmor SELinux Updater 
bash dash cat ls
bin_t karmor_exec_t bin_tkarmor_block_t 
karmor_exec_t /bin/dash karmor_block_t /bin/ls 
karmor SELinux module System Monitor 
(dash) $ ls 
Permission Denied SYS_EXECVE 
PidNS: 1234 
MntNS: 5678 
PPID: 10 
PID: 11 
COMM: ls 
RESULT: -11 SECURITY_BPRM_CHECK 
PidNS: 1234 
MntNS: 5678 
PPID: 9 
PID: 10 
PATH: /bin/dash 
PidNS: 1234 
MntNS: 5678 
PPID: 10 
PID: 11 
PATH: /bin/ls System Monitor (eBPF) 
System Monitor SYS_OEPN … …kprobe, kretprobe, tracepoint Logger (Feeder) 
System Monitor 
PidNS: 1234 
MntNS: 5678 
PPID: 10 
PID: 11 
COMM: ls 
RESULT: -11 PidNS: 1234 
MntNS: 5678 
PPID: 9 
PID: 10 
PATH: /bin/dash 
PidNS: 1234 
MntNS: 5678 
PPID: 10 
PID: 11 
PATH: /bin/ls Platform Handler Container EndPoint 
PidNS: 1234 
MntNS: 5678 
NamespaceName: XXX 
PodName: YYY 
ContainerName: ZZZ NamespaceName: XXX 
PodName: YYY 
List of security policies 
NamespaceName: XXX 
PodName: YYY , ContainerName: ZZZ 
PPID: 10, PID: 11 
Type: MatchedPolicy 
PolicyName: Policy #1 
Source: /bin/dash, Resource: /bin/ls 
Action: Block 
Result: Permission Denied Summary Summary 
Kubernetes 
Multiple VMs 
(KVM Service) 
Self-managed VM Platform Handler 
(k8s, docker, containerd) 
KVM Agent KubeArmor 
Core Engine AppArmor 
Enforcer 
SELinux 
Enforcer 
System 
Monitor 
Logger 
(Feeder) gRPC Service 
karmor CLI Alerts 
Logs BPF-LSM 
Enforcer 
KubeArmor