Introducing KubeArmor
Before we jump into KubeArmor, we need to define a few base concepts you need to be aware of. If you are new to Linux, you may not be familiar with these, and even if you are a Linux veteran, the concepts may still be new to you.
Introduction to Linux Security
In this chapter, you will primarily see two references that need to be understood to understand how KubeArmor protects clusters. The first term is eBPF, which stands for the extended Berkley Packet Filter, and the second one is LSM, which stands for Linux Security Module. In Figure 13.2, you can see how access from a pod goes through KubeArmor before it hits the host’s kernel. This is what allows KubeArmor to secure your runtimes: sitting between the pod runtime and the kernel, to take action before a request is executed.
Figure 13.2: KubeArmor’s high-level design
Now, we need to explain, at a high level, what eBPF and LSMs are and how they help to secure a cluster.
...
