Skip to content
SPECIFICTION
Get listed

KubeArmor

kubearmor.io

Free plan LinuxAPISelf-hosted
Visit kubearmor.io
Spec score 8.6 #3 of 27 in Kubernetes Security Software

What it is

KubeArmor is an open-source runtime security system for enforcing policies on cloud-native workloads. It uses Linux Security Modules such as AppArmor, SELinux, and BPF-LSM, with eBPF for alerts, telemetry, and container-process tracking. Policies can restrict process execution, file access, networking operations, and resource use. Container policies support Allow, Audit, and Block actions, with Block as the default; system-call monitoring is audit-only. Kubernetes policies can target pods through labels and label expressions, and rules can match paths, network protocols, capabilities, and system calls. The deployment matrix covers Kubernetes, non-Kubernetes containers, virtual machines, and bare-metal hosts. It lists Kubernetes environments including GKE, AKS, OKE, IKS, EKS, OpenShift, Rancher, and DigitalOcean Kubernetes, but support varies by operating system, architecture, and enforcement mode. Some environments are observability-only, and VMware Tanzu entries are under construction. KubeArmor is a community-governed CNCF Sandbox project. The free plan is free; installation guidance uses Helm and kubectl.

Spec sheet

What it does
KubeArmor is a cloud-native runtime security enforcement system that restricts process execution, file access, and networking operations for pods, containers, and nodes.Read 9 Oct 2026 · docs.kubearmor.io
Purpose
KubeArmor is an open-source, cloud-native runtime security system that hardens workloads and enforces security policies.Read 9 Oct 2026 · kubearmor.io
Deployment
The support matrix documents Kubernetes, non-Kubernetes container, virtual-machine, and bare-metal workload deployments.Read 9 Oct 2026 · docs.kubearmor.io
Integrations
Project repositories include OpenTelemetry, Prometheus, Kafka, Grafana, ELK dashboards, a GitHub Action, and a Rancher UI extension.Read 9 Oct 2026 · docs.kubearmor.io
Support
Project-level questions can be directed to the maintainer group by email, CNCF Slack, GitHub Discussions, or GitHub Issues.Read 9 Oct 2026 · kubearmor.io
Founded
2020Read 28 Sep 2026 · kubearmor.io
Cloud integrations
The support matrix lists Kubernetes environments including GKE, AKS, OKE, IKS, EKS, OpenShift, and DigitalOcean Kubernetes.Read 9 Oct 2026 · docs.kubearmor.io
Community support
Project-level questions can be directed to the maintainer group by email, and the project provides Slack, GitHub Discussions, and GitHub Issues channels.Read 9 Oct 2026 · kubearmor.io
Deployment options
The support matrix covers Kubernetes workloads, non-Kubernetes containers, virtual machines, and bare-metal hosts.Read 9 Oct 2026 · docs.kubearmor.io
Enforcement
It uses Linux Security Modules including AppArmor, SELinux, and BPF-LSM, with eBPF for alerts and telemetry carrying container, pod, and namespace identities.Read 9 Oct 2026 · docs.kubearmor.io
Hardening guidance
The project documentation describes hardening infrastructure with rules based on MITRE, STIGs, and CIS.Read 9 Oct 2026 · docs.kubearmor.io
Install method
The official site provides Helm commands to add the KubeArmor chart repository and install the KubeArmor Operator.Read 9 Oct 2026 · kubearmor.io
Installation
The getting-started guide installs KubeArmor on a Kubernetes cluster using Helm and kubectl.Read 9 Oct 2026 · docs.kubearmor.io
Intended use
The project describes use for hardening cloud containers, IoT and edge workloads, and 5G networks.Read 9 Oct 2026 · kubearmor.io
Kubernetes policies
Policy development can use Kubernetes metadata, and KubeArmor enforces policies based on container or workload identities.Read 9 Oct 2026 · kubearmor.io
Logging
It records policy violations and tracks container processes using eBPF.Read 9 Oct 2026 · kubearmor.io
Platform support
The matrix lists Kubernetes environments including GKE, AKS, OKE, IKS, EKS, OpenShift, Rancher, DigitalOcean, Alibaba Cloud, and others, with support depending on OS, architecture, and enforcement mode.Read 9 Oct 2026 · docs.kubearmor.io
Policy actions
Container policies support Allow, Audit, and Block actions, with Block as the default; system-call monitoring supports audit only.Read 9 Oct 2026 · docs.kubearmor.io
Policy enforcement
It uses Linux Security Modules such as AppArmor, SELinux, and BPF-LSM to enforce policies at runtime.Read 9 Oct 2026 · docs.kubearmor.io
Policy scope
Policies can match process paths and directories, file paths and directories, network protocols, capabilities, and system calls.Read 9 Oct 2026 · docs.kubearmor.io
Policy targeting
Kubernetes workload policies can select pods using labels and label expressions.Read 9 Oct 2026 · docs.kubearmor.io
Project status
KubeArmor is a community-governed open-source project and a CNCF Sandbox project.Read 9 Oct 2026 · kubearmor.io
Security reporting
The project asks users to report security vulnerabilities through its security process rather than as public GitHub issues.Read 9 Oct 2026 · kubearmor.io
Support limits
The support matrix marks some environments as observability-only, including RHEL or CentOS 8.4 and earlier on Kubernetes and Oracle Ampere; VMware Tanzu entries are marked as under construction.Read 9 Oct 2026 · docs.kubearmor.io
Workload controls
It can restrict process execution, file access, networking operations, and resource use within workloads.Read 9 Oct 2026 · kubearmor.io

Plans and prices

KubeArmor Free Open-source runtime security project · workload and platform support varies by support matrix Read 9 Oct 2026 · kubearmor.io

Every KubeArmor plan and price →

Strong points and limits

Strong points

  • Open-source runtime protection is free.
  • Policies can restrict processes, files, networking, and resource use.
  • Deployment matrix covers Kubernetes and non-Kubernetes workloads.
  • Kubernetes policies can target pods using labels.
  • Integrations include Prometheus, Grafana, and OpenTelemetry.

Limits

  • Workload and platform support varies by environment.
  • Some environments are observability-only.
  • VMware Tanzu entries are under construction.
  • System-call monitoring supports audit only.

Who it suits

KubeArmor suits teams seeking runtime policy enforcement for Kubernetes or other supported workloads. Its intended uses include cloud containers, IoT and edge workloads, and 5G networks.

Verdict

KubeArmor combines runtime controls with policy targeting across Kubernetes and other deployment types. Check the support matrix for the specific environment and enforcement mode before planning a deployment.

Where Specifiction places it

Alternatives to KubeArmorAll alternatives →