KubeArmor

(★ 2,581)

Runtime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (LSM-BPF, AppArmor).

파일 탐색기

최종 버전 다운로드 (.zip)

- - after_pull_request.png
  - app-behavior.png
  - app-behavior2.png
  - bpf-lsm.png
  - cncf-sandbox.png
  - commit_ahead.png
  - deployment-models.png
  - differentiation.png
  - fork_button.png
  - fork_screen.png
  - forked_repo.png
  - harden-workloads.png
  - KA-EKS-architecture.png
  - kubearmor-tls-arch-overview.png
  - kubearmor_overview.png
  - kubearmorhostpolicy-spec-diagram.pdf
  - kubearmorpolicy-spec-diagram.pdf
  - logo.png
  - multi-cloud.png
  - multiubuntu.png
  - network-segmentation.png
  - open_pull_request.png
  - pod security context.png
  - policy_action_conflict.png
  - post-attack-mitigation.png
  - zero-trust.png
- - bug_report.md
  - feature-request-enhancement.md
- - ci-codespell.yml
  - ci-latest-release.yml
  - ci-latest-ubi-release.yml
  - ci-marketplace-release.yml
  - ci-merge-coverage.yaml
  - ci-multiubuntu-push.yml
  - ci-network-tests.yml
  - ci-operator-release.yaml
  - ci-operator-ubi-release.yaml
  - ci-stable-release.yml
  - ci-systemd-release.yml
  - ci-test-controllers.yml
  - ci-test-ginkgo.yml
  - ci-test-go.yml
  - ci-test-helm-charts.yml
  - ci-test-operator.yaml
  - ci-test-systemd.yml
  - ci-test-ubi-image.yml
  - ci-trivy-scan-ubi.yaml
  - ci-trivy-scan.yaml
  - cleanup.sh
  - codeql.yml
  - helm-validate-values.sh
  - install-k3s.sh
  - install-libbpf.sh
  - install-llvm.sh
  - renovate.yml
  - scorecard.yml
- pull_request_template.md
- - install_k3s.sh
  - README.md
- - k3s_installation_killercoda.sh
  - kubearmor-installation-view.sh
- - add-license-header.sh
  - license.header
- - docker-registry.sh
- - install_microk8s.sh
  - README.md
- - install_minikube.sh
  - install_virtualbox.sh
  - README.md
  - start_minikube.sh
- - README.md
  - setup.sh
- - enable_selinux.sh
  - README.md
  - setup.sh
- - dist-upgrade.sh
  - README.md
  - setup.sh
  - time-update.sh
  - Vagrantfile
- contribution_guide.md
- development_guide.md
- KubeArmor Design.pdf
- testing_guide.md
- testing_operator_controller_guide.md
- - cert-manager.yaml
  - install-kubearmor-controller.sh
  - ka-updater-kured.yaml
  - kubearmor-controller-mutating-webhook-config.yaml
  - updaterscript.yaml
- - KubeArmorClusterPolicy.yaml
  - KubeArmorHostPolicy.yaml
  - KubeArmorNetworkPolicy.yaml
  - KubeArmorPolicy.yaml
- - defaults.go
  - objects.go
- - operator.yaml
- - docker-compose.yaml
  - go.mod
  - go.sum
  - Makefile
  - osv-scanner.toml
  - README.md
- go.mod
- go.sum
- main.go
- Makefile
- README.md
- - hsp-k8s-kubearmor-dev-file-dir-allow-fromSource.yaml
  - hsp-k8s-kubearmor-dev-file-dir-block-fromSource.yaml
  - hsp-k8s-kubearmor-dev-file-path-allow-fromSource.yaml
  - hsp-k8s-kubearmor-dev-file-path-audit.yaml
  - hsp-k8s-kubearmor-dev-file-path-block-fromSource.yaml
  - hsp-k8s-kubearmor-dev-file-path-block.yaml
  - hsp-k8s-kubearmor-dev-proc-path-allow-fromSource.yaml
  - hsp-k8s-kubearmor-dev-proc-path-block-fromSource.yaml
  - hsp-k8s-kubearmor-dev-proc-path-block.yaml
  - hsp-nonk8s-kubearmor-dev-file-dir-block-fromsource.yaml
- - multiubuntu-deployment.yaml
  - probe
  - probe_multiubuntu
- - nsp-egress-block-dns.yaml
- - nginx-nginx1-deployment.yaml
  - nginx-nginx2-deployment.yaml
- - sock-shop-deployment.yaml
- - copy.sh
- - wordpress-mysql-deployment.yaml
- kubearmor_containerpolicy.yaml
- multiubuntu.md
- README.md
- sock-shop.md
- vagrant-selinux.md
- wordpress-mysql.md
- - v0.10.md
  - v0.11.md
  - v0.3.md
  - v0.5.md
  - v0.6.md
  - v0.7.md
  - v0.8.md
  - v0.9.md
  - v1.1.md
  - v1.3.md
  - v1.4.md
  - v1.5.md
  - v1.6.md
  - v1.7.md
- - Apparmor-domain-transition.png
  - kubearmor-Apparmor-internals.png
  - KubeArmorMeetup.ics
- - generate-cards.sh
  - hardening.md
  - hardening.template
  - modelarmor-adverserial-attacks.md
  - modelarmor-deploy-pytorch.md
  - modelarmor-pickle-code.md
  - modelarmor.md
  - README.md
- alert_throttling.md
- cluster_security_policy_examples.md
- cluster_security_policy_specification.md
- consideration_in_policy_action.md
- default_posture.md
- deployment_guide.md
- deployment_models.md
- differentiation.md
- dns_visibility.md
- FAQ.md
- hardening-report.html
- hardening_guide.md
- host_security_policy_examples.md
- host_security_policy_specification.md
- kubearmor-events.md
- kubearmor-security-enhancements.md
- kubearmor_apparmor_implementation_overview.md
- kubearmor_dns_enforcement.md
- kubearmor_installation_on_gke_autopilot.md
- kubearmor_visibility.md
- kubearmor_vm.md
- least_permissive_access.md
- network_bandwidth_quota.md
- network_policy_enforcer.md
- network_security_policy_examples.md
- network_security_policy_specification.md
- network_segmentation.md
- process_arguments.md
- profiling_kubearmor_logs.md
- release_notes.md
- security_policy_examples.md
- security_policy_specification.md
- styleguide.md
- support_matrix.md
- usb_device_handler.md
- use-cases.md
- workload_visibility.md
- - anonmapexec.bpf.c
  - arg_matching_helpers.h
  - common_types.h
  - enforcer.bpf.c
  - enforcer_path.bpf.c
  - exec.bpf.c
  - filelessexec.bpf.c
  - ima_hash.bpf.c
  - ima_hash.h
  - kernel_helpers.h
  - kubearmor_config.h
  - libbpf
  - Makefile
  - Makefile.vars
  - probe.bpf.c
  - protectenv.bpf.c
  - protectproc.bpf.c
  - shared.h
  - syscalls.h
  - system_monitor.c
  - throttling.h
  - visibility.h
  - vmlinux_macro.h
- - build_kubearmor.sh
  - build_kubearmor_ubi.sh
  - compile.sh
  - kubearmor-helm-test-values.yaml
  - Makefile
  - push_kubearmor.sh
  - push_kubearmor_ubi.sh
  - test_kubearmor.sh
- - buildinfo.go
- - cert.go
  - certloader.go
  - tls.go
- - bpffs.go
  - common.go
- - config.go
- - containerdHandler.go
  - containerdHandler_test.go
  - crioHandler.go
  - dockerHandler.go
  - hook_handler.go
  - hook_handlier_non_k8s.go
  - k8sHandler.go
  - karmorprobedata.go
  - kubeArmor.go
  - kubeUpdate.go
  - kubeUpdate_race_test.go
  - nriHandler.go
  - unorchestratedUpdates.go
- - apparmorContainerProfile.go
  - appArmorEnforcer.go
  - appArmorEnforcer_test.go
  - appArmorProfile.go
  - appArmorTemplate.go
  - runtimeEnforcer.go
  - SELinuxEnforcer.go
  - SELinuxEnforcer_test.go
  - SELinuxHostProfile.go
- - feeder.go
  - feeder_test.go
  - logServer.go
  - policyMatcher.go
- - build.sh
- - kvmAgent.go
- - logger.go
- - ima_hash_bpfeb.go
  - ima_hash_bpfeb.o
  - ima_hash_bpfel.go
  - ima_hash_bpfel.o
  - imaHash.go
  - logUpdate.go
  - processTree.go
  - syscallParser.go
  - syscalls_amd64.go
  - syscalls_arm64.go
  - systemMonitor.go
  - systemMonitor_test.go
- - networkPolicyEnforcer.go
  - networkPolicyEnforcer_test.go
- - kubearmor.service
  - kubearmor.yaml
  - post-install.sh
- - policy.go
  - policy_test.go
- - presets.go
- - data.go
  - stateAgent.go
- - install.sh
  - karmor.te
  - uninstall.sh
- - types.go
- - usbDeviceHandler.go
  - usbDeviceHandler_test.go
- .goreleaser.yaml
- go.mod
- go.sum
- main.go
- main_test.go
- Makefile
- osv-scanner.toml
- - .dockerignore
  - .gitignore
  - Dockerfile
  - go.mod
  - go.sum
  - LICENSE
  - Makefile
  - PROJECT
- - bundle.Dockerfile
  - Dockerfile
  - go.mod
  - go.sum
  - Makefile
  - osv-scanner.toml
  - PROJECT
- README.md
- go.mod
- go.sum
- kubearmor.pb.go
- kubearmor.proto
- kubearmor_grpc.pb.go
- kvm.pb.go
- kvm.proto
- kvm_grpc.pb.go
- Makefile
- policy.pb.go
- policy.proto
- policy_grpc.pb.go
- state.pb.go
- state.proto
- state_grpc.pb.go
- - Makefile
  - README.md
  - test-scenarios-github.sh
  - test-scenarios-in-runtime.sh
  - test-scenarios-local.sh
  - tests.allow
  - tests.ignore
- - Makefile
- - karmorlog.go
  - kartutil.go
- go.mod
- go.sum
- bpf.md
- container_node_identity.md
- kubearmor_daemon.md
- kubearmor_overview.md
- log_feeder.md
- oci_hooks_kubearmor.md
- runtime_enforcer.md
- security_policy.md
- system_monitor.md
.codespellrc
.dockerignore
.gitignore
.gitmodules
.licenserc.yaml
ADOPTERS.md
CODE_OF_CONDUCT.md
codecov.yml
CODEOWNERS
CONTRIBUTING.md
Dockerfile
Dockerfile.init
GOVERNANCE.md
LICENSE
MAINTAINERS.md
README.md
RELEASES.md
renovate.json
SECURITY.md
STABLE-RELEASE
SUMMARY.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/kubearmor/KubeArmor

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd KubeArmor

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Docker

쉬움 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Docker Desktop 컨테이너를 빌드하고 실행하려면 필요합니다. 설치 후 실행해서 백그라운드에 켜두세요.

docker compose -f deployments/podman/docker-compose.yaml up -d --build

compose 설정 파일에 정의된 서비스들을 대상으로 명령을 실행합니다.

✅ 터미널에 docker compose ps 를 입력해 컨테이너들이 Up 상태인지 확인하세요. README에 포트 번호가 적혀있다면 브라우저에서 http://localhost:포트번호 로 접속해보세요.

3. Go

보통

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Go Go 언어 컴파일러 및 도구 모음입니다.

cd KubeArmor

이 프로젝트의 관련 파일이 하위 폴더 안에 있어서, 먼저 그 폴더로 이동합니다.

go build ./...

Go 프로그램을 컴파일해 실행 파일을 만듭니다.

go run .

따로 빌드하지 않고 바로 Go 프로그램을 실행합니다.

✅ 빌드가 에러 없이 끝나면 성공입니다. go run . 을 썼다면 터미널 출력을 확인하세요.

4. Make

보통

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Make Linux/macOS는 보통 기본 설치되어 있습니다. Windows는 별도 설치(예: MSYS2, WSL)가 필요합니다.

cd KubeArmor/BPF

이 프로젝트의 관련 파일이 하위 폴더 안에 있어서, 먼저 그 폴더로 이동합니다.

make

생성된 빌드 설정을 바탕으로 실제 컴파일을 진행해 실행 파일을 만듭니다.

✅ 에러 없이 끝나면 성공입니다. 생성된 실행 파일을 직접 실행해보세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

KubeArmor

파일 탐색기

# 설치 가이드

2. Docker

3. Go

4. Make

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

KubeArmor

파일 탐색기

# 설치 가이드

2. Docker

3. Go

4. Make

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README