LoginSign Up
← Back to all sparks
K

KubeArmor

INFRA · APIS
Velocity2.5

Runtime security enforcement system for Kubernetes

kubearmor.io ↗

Every release in the feed is a candidate — the stable line is decided elsewhere.

kubernetesebpfruntime-securitypolicy-enforcementkernel-compatibilityrelease-candidates
◆Current state
KubeArmor's tracked feed contains only release candidates: three for 1.7.4 and one for 1.7.5, with no stable tag among them. The work divides into eBPF-level observability (DNS visibility moved from udp_sendmsg to udp_send_skb, DNS support and a verifier for kernel 6.17), platform compatibility (Ubuntu 26.04, openEuler 24.03 LTS-SP3, RHEL kernel iov handling), and supply-chain scoring — Renovate integration, workflow token permissions and provenance generation explicitly aimed at OpenSSF Scorecard numbers. Contribution is broad, with a dozen or more named authors per candidate.
◆Where it's heading
Kernel-version chase is the dominant constraint. An eBPF enforcement agent has to track kernel internals release by release, and a meaningful share of each candidate goes to keeping probes attached across new kernels and distributions rather than adding policy capability. The one genuine capability attempt in this window — TLD and subdomain enforcement — was merged and then reverted within the same release candidate, which suggests network-identity policy is being worked on and is not yet stable.
◆Prediction
Expect TLD and subdomain enforcement to return once the regression behind the revert is resolved, and continued kernel and distribution matrix expansion. Whether 1.7.4 ever reached a stable tag is not visible in this feed.

◆Recent moves

  1. 27d ago

    DNS visibility moves to the udp_send_skb probe point

    Switches DNS visibility instrumentation from udp_sendmsg to udp_send_skb, a lower-level attach point in the kernel's UDP transmit path, and adds sample policies for database protection. The eBPF probe refinement is the substance; the rest is test coverage and code ownership housekeeping.

    View source ↗
  2. 1mo ago

    Kernel 6.17 DNS support and Ubuntu 26.04 compatibility

    Adds DNS support and a verifier for kernel 6.17 plus Ubuntu 26.04 and openEuler 24.03 support, fixes containerd CVEs, and rate-limits drop logs that were causing memory spikes. A representative candidate: mostly keeping the agent attached across new kernels and distributions.

    View source ↗
  3. 1mo ago

    Hostname policy matching improved; TLD enforcement reverted

    Improves policy matching for hostnames and adds a gRPC-based liveness healthcheck, but the notable detail is that TLD and subdomain enforcement was added and reverted within the same candidate. Network-identity policy is being attempted and has not yet held.

    View source ↗
  4. 2mo ago

    Opening 1.7.4 candidate with dependency and CI updates

    A raw commit list of dependency updates, a Go upgrade to clear a vulnerability, CI certification fixes and a non-root image change that was later reverted. Opening candidate for the 1.7.4 cycle with no user-facing capability.

    View source ↗