KubeArmor
KubeArmor copied to clipboard
Support for un-orchestrated containerd containers
Purpose of PR?: When it comes to unorchestrated or non-kubernetes containers, right now KubeArmor works the best only with Docker runtime but not for containerd runtime,this PR fixes the issue related to monitoring and enforcement of containerd containers
Fixes #1426
Does this PR introduce a breaking change? No
Apply this policy to a contianerd container
apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
name: ksp-block-policy
spec:
severity: 3
selector:
matchLabels:
kubearmor.io/container.name: nerdctl-nginx-jul-21
process:
matchPaths:
- path: /usr/bin/ls
- path: /usr/bin/sleep
- path: /usr/bin/curl
action:
Block
It blocks showing enforcement
Checklist:
- [ ] Bug fix. Fixes #1426
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
- [ ] This change requires a documentation update
- [ ] PR Title follows the convention of
<type>(<scope>): <subject>
- [ ] Commit has unit tests
- [ ] Commit has integration tests