LoginSign Up
← Back to all sparks
K

KubeArmor

INFRA · APIS
Velocity5.0

Runtime security enforcement system for Kubernetes

kubearmor.io ↗

KubeArmor is hardening its eBPF DNS visibility and supply chain security posture in the v1.7.5 pre-release cycle.

kubernetessecurityebpfopen-sourcecontainer-securitysupply-chain
◆Current state
KubeArmor is in active pre-release for v1.7.5, having shipped three release candidates. The rc1 switched the BPF hook for DNS traffic from udp_sendmsg to udp_send_skb — a kernel-level change that captures DNS at the correct interception point for accurate visibility. The rc2 added SLSA Level 3 provenance, isolated container builds, and improved OpenSSF Scorecard compliance to the project's build and release pipeline. Support for Ubuntu 26.04, openEuler 24.03 LTS-SP3, and kernel 6.17 DNS tracking arrived in the 1.7.4-rc3 cycle.
◆Where it's heading
KubeArmor is running two parallel improvement tracks: eBPF policy enforcement quality (BPF hook changes, quota handling via NPE, hostname/TLD matching improvements) and supply chain security compliance (SLSA, Scorecard, pinned dependencies, isolated builds). The latter is increasingly a table-stakes requirement for enterprise Kubernetes security teams auditing their toolchain, not a differentiator. New kernel and OS support signals broadening the deployment surface — particularly for regulated environments with specific OS requirements.
◆Prediction
v1.7.5 stable will ship shortly given three RCs already published. The eBPF DNS visibility change enables syscall-level DNS auditing for workloads that need it; the SLSA Level 3 provenance will be cited in enterprise security reviews as a prerequisite for adoption.

◆Recent moves

  1. 14d ago

    KubeArmor 1.7.5 release candidate 3

    v1.7.5-rc3 fixes the Node.js version in CI, adds a skip-validate flag, and corrects a CD path in the systemd release workflow — CI housekeeping ahead of stable release.

    View source ↗
  2. 16d ago

    v1.7.5-rc2

    v1.7.5-rc2 adds SLSA Level 3 provenance and isolated container builds to the release pipeline — a meaningful supply chain security upgrade that makes each release cryptographically verifiable. Also bumps Go to 1.26.5, grpc to v1.82.1, and improves OpenSSF Scorecard compliance. For enterprise security teams evaluating Kubernetes policy enforcement tools, SLSA Level 3 is increasingly a procurement checkbox.

    View source ↗
  3. 2mo ago

    KubeArmor 1.7.5 RC1: eBPF DNS hook corrected to udp_send_skb

    v1.7.5-rc1 switches the BPF hook for DNS traffic monitoring from udp_sendmsg to udp_send_skb — a kernel hook change that captures DNS traffic at the correct point in the network stack for reliable visibility. The change improves test coverage for the main package and marks a stable version tag update.

    View source ↗
  4. 2mo ago

    v1.7.4-rc3

    v1.7.4-rc3 adds DNS support for kernel 6.17, openEuler 24.03 LTS-SP3 to the supported matrix, Ubuntu 26.04 compatibility, and a rate limiter on drop logs to prevent memory spikes under high event volume. Broadening OS and kernel support expands the deployment surface without changing the core enforcement model.

    View source ↗
  5. 2mo ago

    v1.7.4-rc2

    v1.7.4-rc2 improves hostname-based policy matching, adds TLD and subdomain enforcement for network policies, fixes a panic on closed channel, and adds a gRPC healthcheck to the liveness probe. These are enforcement-quality improvements that close gaps in the policy model for real-world network traffic patterns.

    View source ↗
  6. 3mo ago

    KubeArmor 1.7.4 release candidate 1

    v1.7.4-rc1 updates the Go version to fix vulnerabilities, bumps several dependencies, and makes the snitch UBI image non-root for OpenShift certification — CI and compliance housekeeping.

    View source ↗