search

kubearmor / KubeArmor

Runtime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (BPF-LSM, AppArmor).
https://kubearmor.io/
Apache License 2.0
1.45k stars 335 forks source link

Performance benchmarking of KubeArmor #995

Open Shreyas220 opened 1 year ago

Shreyas220 commented 1 year ago

Aim

The aim of performance test is to Check impact of kubearmor on existing app.

Platform

Shreyas220 commented 1 year ago

Initial Result of Benchmarking Redis link to sheet

nyrahul commented 1 year ago

Performance Requirements based on the discussion today:

  1. Ability to enable/disable visibility at host, namespace, deployment level.
  2. Ability to enable/disable visibility at operation level: Process/Network/File/Capability.
  3. Drop the filtered events in kernel space
  4. If I have an audit policy, I should receive audit events even if visibility is disabled.
  5. Lost events notifications.
  6. Ability to enable/disable visibility at runtime using annotations.

CC: @achrefbensaad