LoginSign Up
← Back to all sparks
K

KubeArmor

INFRA · APIS
Velocity5.0

Runtime security enforcement system for Kubernetes

kubearmor.io ↗

KubeArmor ships fixes as release-candidate tags, and its feed misses the finals.

kubernetesruntime-securityebpfapparmorarm64
◆Current state
KubeArmor's feed shows five release-candidate tags and one merge-commit entry from October for 1.7.6 and 1.7.7, each carrying one or two commits: a relay-channel memory leak fix with pprof added, a snitch fix, removed limits and an AppArmor alert-throttling fix. GitHub shows 1.7.6 went final on 23 October, which the feed missed; it replaced the execve kprobe with a tracepoint, fixed pods not terminating on AppArmor nodes, added audit alerts from the BPF-LSM enforcer and expanded arm64 eBPF testing.
◆Where it's heading
The project is mid-way through stabilising its eBPF enforcement across architectures: arm64 syscall matching, multi-arch image tests and the move from kprobes to tracepoints all reduce kernel-specific breakage. The release process remains RC-heavy, with near-identical tags cut minutes apart, which makes the feed a poor guide to what users actually get.
◆Prediction
Expect 1.7.7 final soon after rc1, carrying the AppArmor throttling fix. The arm64 work in 1.7.6 suggests further multi-architecture fixes rather than new policy features next.

◆Recent moves

  1. 10d ago

    1.7.7-rc1 fixes AppArmor alert throttling

    The 1.7.7 candidate fixes alert throttling for AppArmor default-posture logs and repairs the stable-release workflow. A narrow fix following the 1.7.6 final that the feed did not capture.

    View source ↗
  2. 12d ago

    Duplicate 1.7.7-rc1 entry: AppArmor alert throttling fix

    A duplicate entry for the same 1.7.7-rc1 change, captured from the merge commit two days before the release tag.

    View source ↗
  3. 19d ago

    1.7.6-rc6 backports a snitch fix

    The last 1.7.6 candidate, carrying a single backported snitch fix two days before the 1.7.6 final.

    View source ↗
  4. 1mo ago

    1.7.6-rc5: a single 'remove limits' change

    A candidate whose only listed change is a commit titled 'remove limits', with no further detail in the notes.

    View source ↗
  5. 1mo ago

    1.7.6-rc4 fixes a relay-channel memory leak, adds pprof

    Fixes a memory leak in the relay channel and adds pprof profiling, plus quieter event-drop logging. The leak fix is the one change in this run of candidates that operators would notice in long-running clusters.

    View source ↗
  6. 1mo ago

    1.7.6-rc3: same commits as rc4

    Lists the same commits as rc4, cut a day earlier. No separate content.

    View source ↗