Kubearmor 1.2: Runtime Security Enforcement Enhancements

Introduction

Kubearmor 1.2, released on November 5, 2024, advances runtime security enforcement with improved policy enforcement, enhanced observability, better performance, and expanded integration capabilities. This release makes Kubearmor more powerful for protecting Kubernetes workloads.

Policy Enforcement

• Policy evaluation improvements reduce latency for policy enforcement decisions.
• Policy matching optimizations improve performance for complex policy rules.
• Policy reporting provides visibility into policy enforcement and violations.
• Policy as code support enables version-controlled policy management.

Observability Enhancements

1. Event logging improvements enable better visibility into security events.
2. Metrics expansion provides detailed metrics for security operations.
3. Alerting integration enables integration with alerting systems.
4. Dashboard integration provides visualization of security events.

Performance Optimizations

• Enforcement overhead reductions minimize the overhead of policy enforcement.
• Resource usage optimizations reduce CPU and memory consumption.
• Scaling improvements enable better handling of large numbers of pods.
• Caching improvements provide better response times.

Integration Capabilities

• Kubernetes integration improvements provide seamless integration with Kubernetes.
• Security tool integration enables integration with security tools.
• SIEM integration enables integration with security information and event management systems.
• API improvements enable better programmatic access to Kubearmor capabilities.

Getting Started

# Install Kubearmor
kubectl apply -f https://raw.githubusercontent.com/kubearmor/kubearmor-client/main/deployments/kubearmor.yaml

Create a KubeArmorPolicy:

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: ksp-block-syscalls
spec:
  selector:
    matchLabels:
      app: myapp
  process:
    matchPaths:
    - path: /usr/bin/bash
  syscall:
    matchSyscalls:
    - syscall: execve
      action: Block

Summary

Kubearmor 1.2 continues to evolve as a leading runtime security solution, providing teams with powerful capabilities for protecting Kubernetes workloads.