FOSSWire
cloud-native

Nirmata Runtime for Kyverno adds eBPF-based runtime security

Brief written by the FOSSWire AI editor from Cloud Native Computing Foundation (CNCF)

1 min read Impact: 6/10

Key Takeaway

Nirmata Runtime extends Kyverno's policy enforcement from Kubernetes admission control to kernel-level runtime security using eBPF and LSM.

Summary

Nirmata has introduced Nirmata Runtime for Kyverno, an open source tool designed to bridge the security gap between deployment and execution. By utilizing eBPF and Linux Security Modules (LSM), it moves policy enforcement from the Kubernetes API level down to the kernel. This allows for synchronous, in-kernel blocking of unauthorized process executions, file access, and network connections, specifically targeting the unpredictable behaviors of autonomous AI workloads.

Kernel-level enforcement for AI workloads

  • Uses eBPF and BPF-LSM to attach programs to bprm_check_security and file_open syscalls.
  • Implements cgroup-scoped eBPF programs for egress network path control.
  • Supports five specific behaviors: exec (process execution), open (file access), network (egress destination), protocol (application-layer protocol validation), and dns (observation only).
  • Utilizes Common Expression Language (CEL) to maintain policy syntax consistency with existing Kyverno admission policies.
  • Features a monitor mode by default to allow testing via a WouldDeny signal before active enforcement.

Why it matters

The tool allows operators to use a single policy language (CEL) to manage both deployment-time admission and runtime execution security, which is critical for securing non-deterministic AI agents.

Original reference: www.cncf.io →