KubeArmor

Term 2 · Jun-Aug · 1 project

• KubeArmor Supply Chain Security with SLSA Level 3 Compliance and OpenSSF Scorecard Hardening

  LFX Mentorship · Listed in the official cohort

  @rootxrishabhSource IssueLFX portal

  KubeArmor is a runtime security engine that enforces zero-trust policies at the kernel level. As a security-critical project in the CNCF ecosystem, it must hold its own supply chain to the highest standards. This project focuses on two tightly related goals. First, achieving SLSA Level 3 compliance by auditing KubeArmor's build and release pipeline against the full SLSA L3 specification — covering hermetic builds, non-falsifiable provenance generation via SLSA GitHub Actions, and signed release attestations using cosign. KubeArmor already signs container images; this project closes the remaining gaps by following a strategy similar to KubeEdge's documented SLSA L3 journey. Second, improving KubeArmor's OpenSSF Scorecard rating by systematically addressing low-scoring checks - including Signed-Releases, Fuzzing (OSS-Fuzz integration), SAST (CodeQL), Pinned-Dependencies, and CII Best Practices. Also integrating the Scorecard GitHub Action into CI for continuous score tracking. The pre-task for mentee candidates will be submitting a pull request that enables and verifies the Signed-Releases check on KubeArmor's OpenSSF Scorecard, establishing a clear baseline before the full term begins.

  • Go
  • GitHub Actions
  • cosign
  • SLSA framework (slsa-github-generator)
  • OpenSSF Scorecard
  • CI/CD pipelines
  • +2

Term 3 · Sep-Nov · 2 projects

• KubeArmor Observability Spectrum Enhancement

  LFX Mentorship · Listed in the official cohort

  @rootxrishabhSource IssueLFX portal

  This project focuses on improving KubeArmor's observability by integrating key Prometheus metrics. The goal is to offer simple explanations for security policy enforcement and alerting within Kubernetes clusters.

  • Go
  • Prometheus
  • Kubernetes
  • Git

• KubeArmor Unit Test Coverage Audit

  LFX Mentorship · Listed in the official cohort

  @rootxrishabhSource IssueLFX portal

  This project aims to systematically analyze and substantially improve KubeArmor's unit test coverage. It involves identifying untested code paths, designing and implementing new unit tests for crucial modules, and establishing a robust testing framework to boost code quality.

  • Go
  • Kubernetes
  • Testing Methodologies (unit testing
  • mocking)
  • Git.

Term 1 · Mar-May · 1 project

• Providing Zero-Trust policies for popular workloads

  LFX Mentorship · Listed in the official cohort

  @rootxrishabhSource IssueLFX portal

  KubeArmor can whitelist processes and assets based on set of rules provided through the policies. This feature allows KubeArmor to achieve zero trust for a workload. However, knowing the allowed behaviour for a workload and manually creating these policies is a pain. Therefore we want to provide Zero-trust policies for popular workloads like grafana, WordPress, redis, etc. (let's say some 100 workloads). We want to make these Zero-Trust policies available as artifacts.

  • familiarity with Golang
  • K8s CRD(Custom Resource Definition)
  • YAML.

Term 3 · Sep-Nov · 3 projects

• Implement Fuzz testing for KubeArmor Components

  LFX Mentorship · Listed in the official cohort

  @daemon1024Source IssueLFX portal

  Implement fuzz testing for KubeArmor using a suitable tool like oss-fuzz or AFL. Generate a comprehensive input set to guide the fuzz testing, profile execution using tools like pprof to detect anomalies, and identify components such as the policy controller, operator, configmap handler, and GRPC endpoints for testing. Document the entire process for repeatability in future versions and develop an automation strategy for ongoing fuzz testing.

  • Go
  • Kubernetes
  • Fuzz Testing Experience

• Non K8s KubeArmor Enhancements

  LFX Mentorship · Listed in the official cohort

  @daemon1024Source IssueLFX portal

  Extend KubeArmor features to non-Kubernetes environments by implementing karmor recommend for host policies and unorchestrated containers, and enabling dynamic configuration for default posture and visibility through kubearmor.yaml, a new gRPC service, and karmor commands. Enhance karmor profile for host logs, support karmor install for VMs, and validate policies for non-Kubernetes setups.

  • Go
  • Container Runtime Interface
  • Linux

• Support Podman and OCI Hooks support for unorchestrated environments

  LFX Mentorship · Listed in the official cohort

  @daemon1024Source IssueLFX portal

  Leverage OCI hooks to obtain container start/stop events and container details for KubeArmor, replacing the current UNIX domain socket file method. Integrate Podman support for unorchestrated environments, ensuring policy enforcement and alerts/telemetry validation. Design the implementation to gather necessary container information and verify functionality with Podman as well as Containerd without Unix Socket.

  • Go
  • Container Runtime Interface
  • Linux

Term 2 · Jun-Aug · 1 project

• Improve System Test Coverage and Pratices for KubeArmor

  LFX Mentorship · Listed in the official cohort

  @daemon1024Source IssueLFX portal

  KubeArmor supports securing many environments ranging from Kubernetes, unorchestrated containers, bare metal and virtual machines. Our testing matrix however doesn't cover many of these completely. In this project, we plan to improve this coverage by introducing automated testing of some of these environments and imrove the scenarios covered in some existing ones. These tests would be written using the Ginkgo framework and automated via GitHub workflows. The matrix we'll target can be found in the upstream issue.

  • Go
  • Scripting
  • Kubernetes
  • CI/CD (GitHub Actions)

Term 1 · Mar-May · 3 projects

• Dashboards for application behavior and KubeArmor state

  LFX Mentorship · Listed in the official cohort

  @daemon1024Source IssueLFX portal

  For showing an application's behaviour, we'd like to have a Kibana/Grafana dashboard. We have existing integrations for visualizing alerts with Elastic/Loki and we can use them for creating these. We want to leverage the above for creating a plugin which will allow users to see an application's behavior based on visibility logs sent by KubeArmor.

  • Grafana
  • Javascript
  • Go
  • Kubernetes
  • Linux

• Kubearmor Kata Container Support

  LFX Mentorship · Listed in the official cohort

  @daemon1024Source IssueLFX portal

  Kata Containers is an open source community working to build a secure container runtime with lightweight virtual machines that feel and perform like containers, but provide stronger workload isolation using hardware virtualization technology as a second layer of defense.

  • Go
  • Kubernetes
  • Linux

• Leverage OCI Hooks for Container Events

  LFX Mentorship · Listed in the official cohort

  @daemon1024Source IssueLFX portal

  Use OCI hooks and get events in context to container start/stop: Currently KubeArmor mounts docker/containerd/crio UNIX domain socket file in KubeArmor to watch for container events. The aim is to use OCI hooks for getting such container events.

  • Go
  • Kubernetes
  • Linux

Term 3 · Sep-Nov · 2 projects

• Extend Support Matrix and Document Usecases

  LFX Mentorship · Listed in the official cohort

  @kranurag7Source IssueLFX portal

  The project aims to extend KubeArmor support and document how KubeArmor is relevant for securing Kubernetes on Edge in addition to generic Kubernetes based Application deployments

  • Kubernetes
  • Basic understanding of KubeArmor
  • Content Writing is a plus.

• Implement DNS visibility with KubeArmor II

  LFX Mentorship · Listed in the official cohort

  @kranurag7Source IssueLFX portal

  The project aims to provide better visibility into the domains accessed from pods, with a focus on identifying and containing attacks that use techniques like Domain Generation Algorithms (DGA) to connect to remote command and control (C&C) servers. By gathering information on which domains are being accessed and applying network rules to allow only specific domains, the project aims to empower security operations (secops) teams to better prevent and respond to such attacks.

  • Go
  • Kubernetes
  • eBPF. familiarity with network security and a basic understanding of KubeArmor is a plus.

Term 2 · Jun-Aug · 2 projects

• Implement DNS visibility with KubeArmor

  LFX Mentorship · Listed in the official cohort

  @kranurag7Source IssueLFX portal

  The project aims to provide better visibility into the domains accessed from pods, with a focus on identifying and containing attacks that use techniques like Domain Generation Algorithms (DGA) to connect to remote command and control (C&C) servers. By gathering information on which domains are being accessed and applying network rules to allow only specific domains, the project aims to empower security operations (secops) teams to better prevent and respond to such attacks.

  • Go
  • Kubernetes
  • familiarity with network security and a basic understanding of KubeArmor is a plus.

• Manage KubeArmor policies using OCI registry and use OCI hooks for container events

  LFX Mentorship · Listed in the official cohort

  @kranurag7Source IssueLFX portal

  The feature aims to manage KubeArmor policies using OCI registry and use OCI hooks to get container events. Currently, KubeArmor uses a UNIX domain socket file to watch for container events, but the proposed feature aims to use OCI hooks instead.

  • Go
  • Kubernetes
  • understanding of the Open Container Initiative (OCI) and container runtimes.

Term 1 · Mar-May · 3 projects

• Adding OpenTelemetry Support

  LFX Mentorship · Listed in the official cohort

  @kranurag7Source IssueLFX portal

  To integrate KubeArmor with OpenTelemetry, an adapter needs to be created. OpenTelemetry is a standard for telemetry data, including distributed tracing, metrics, and logs, and has an SDK and a collector component that can run on Kubernetes. Applications can directly expose OpenTelemetry data through in-app instrumentation using the OpenTelemetry SDK. The collector can then gather data from multiple applications in a cluster and send it to various backends for storage and visualization, such as Jaeger.

  • OpenTelemetry
  • Go

• KubeArmor Telemetry Monitoring and Dashboards

  LFX Mentorship · Listed in the official cohort

  @kranurag7Source IssueLFX portal

  KubeArmor generates a large amount of data through logs and alerts, but interpreting this data can be difficult. To make it easier to understand, it is necessary to parse the telemetry, create meaningful metrics, enable data filtering, and create visualizations such as graphs to display on a dashboard.

  • ELK stack (Elasticsearch
  • Logstash & Kibana)
  • Fluentd
  • Loki and Grafana

• Rancher Plugin Integration

  LFX Mentorship · Listed in the official cohort

  @kranurag7Source IssueLFX portal

  The goal is to create an extension for Rancher, a Kubernetes management platform, which will enable interaction with KubeArmor. The extension will have the capability to install KubeArmor, allow for the management of security policies, and provide monitoring of workload behavior through alerts and telemetry.

  • Rancher
  • Grafana stack
  • Javascript

Term 3 · Sep-Nov · 2 projects

• Add BTF and BPF CO-RE Support to KubeArmor

  LFX Mentorship · Listed in the official cohort

  @Ankurk99Source IssueLFX portal

  Currently KubeArmor depends on kernel headers to use various kernel structures. This creates difficulty in having portability. Linux Kernel versions with BTF (BPF Type Format) information available allows us to write portable BPF CO-RE (or Compile Once - Run Everywhere) applications that can run on multiple kernel versions and configurations without any modification or runtime compilation on the target machine. But there is a restriction that CO-RE requires to have the BTF information of the target kernel, which is provided by the kernel itself when it's compiled with CONFIG_DEBUG_INFO_BTF=y. This option was introduced in Linux 5.2. For kernels < 5.2 we can use BTFGen to ship BTF information with KubeArmor code or use pahole to generate BTF information from the vmlinux image (with DWARF information) at runtime. The project aims to make KubeArmor truly portable across all kernel versions by reducing host environment dependencies.

  • Kernel
  • go
  • C

• Use non-privileged containers for KubeArmor daemonset

  LFX Mentorship · Listed in the official cohort

  @Ankurk99Source IssueLFX portal

  KubeArmor currently uses privileged mode for its daemonset containers. But it is not a good practice. Privileged containers are usually frowned upon. In many cases, specific admission controllers are deployed to not allow containers to be installed in privileged mode. It is best to not use privileged mode but to define specific capabilities for KubeArmor. The aim of the project is to analyse and reduce the system privileges required by KubeArmor, thereby reducing the potential attack surface.

  • go
  • Kernel
  • Kubernetes

Term 0 · 2022 Summer (Jun-Aug) · 3 projects

• Extend kArmor to include KubeArmor configuration

  LFX Mentorship · Listed in the official cohort

  @Ankurk99Source IssueLFX portal

  KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operation) of containers and nodes (VMs) at the system level. kArmor is a KubeArmor CLI tool that connects to the kubearmor-relay service to provide command-line telemetry and observability data. The project aims to extend KubeArmor CLI-tool kArmor to check KubeArmor configurations in the running environment. This feature will provide various information about KubeArmor like the current running mode (audit or enforcement), the enforcer used by KubeArmor (SELinux or AppArmor or BPF-LSM), whether it's running in systemd mode or on k8s, etc.

  • go
  • Kubernetes

• Support for OpenShift

  LFX Mentorship · Listed in the official cohort

  @Ankurk99Source IssueLFX portal

  KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operation) of containers and nodes (VMs) at the system level. This project aims to support KubeArmor on OpenShift. The work will include compatibility analysis of KubeArmor on OpenShift, finding limitations (if any), and eventually testing it on OpenShift.

  • OpenShift
  • Kubernetes

• Supporting KubeArmor on ARM platforms

  LFX Mentorship · Listed in the official cohort

  @Ankurk99Source IssueLFX portal

  KubeArmor has garnered interests from edge computing platforms (such as LF Edge OpenHorizon) that leverages k8s control plane for workload orchestration. The primary requirement is to support ARM platforms that are prevalent on the edge devices (especially Raspberry PI). KubeArmor leverages eBPF for observability and Linux Security Modules (such as AppArmor) for policy enforcement. One of the challenges is to check if the eBPF primitives such as observing kprobe, kretprobe, tracepoints that are typically available on the x86 platform are also available on the ARM platform and check if the parameter list fulfills the requirement. Post this analysis, the KubeArmor code might have to be changed to accommodate any differences in the eBPF behavior.

  • Go
  • raspberry-pi
  • ebpf
  • Kubernetes

Term 0 · 2022 Spring (Mar-May) · 2 projects

• Extending kubearmor-cli-tool filtering options

  LFX Mentorship · Listed in the official cohort

  @daemon1024Source IssueLFX portal

  KubeArmor is Cloud Native Runtime Security Enforcement System that restricts the behavior (such as process execution, file access, and networking operation) of containers and nodes at the system level using Linux Kernel LSMs (Linux Security Modules) and eBPF. KubeArmor cli-tool (aka karmor) connects to the kubearmor-relay service to provide command-line telemetry/observability. Karmor cli options could be extended to support various other parameters as described in the given issue. KubeArmor is Cloud Native Runtime Security Enforcement System that restricts the behavior of containers and nodes at the system level using Linux Kernel LSMs (Linux Security Modules) and eBPF. KubeArmor applies container/pod annotations to achieve some of the goals. Currently, these annotations are applied using k8s rolling update feature that results in pod getting terminated and recreated. Mutating webhooks could achieve the same functionality in a much cleaner way without having to terminate the pods.

  • Go
  • Kubernetes

• Using mutating webhooks for applying pod/container kubearmor annotations

  LFX Mentorship · Proposed, acceptance not recorded

  @nam-jaehyunSource Issue

  KubeArmor is Cloud Native Runtime Security Enforcement System that restricts the behavior of containers and nodes at the system level using Linux Kernel LSMs (Linux Security Modules) and eBPF. KubeArmor applies container/pod annotations to achieve some of the goals. Currently, these annotations are applied using k8s rolling update feature that results in pod getting terminated and recreated. Mutating webhooks could achieve the same functionality in a much cleaner way without having to terminate the pods.

  • Go
  • Kubernetes