observability and policy discovery helper tool

[nyrahul]

Feature Request

Short Description

KubeArmor, apart from been a policy enforcement engine also emits pod/container visibility data that can be used for observability use-cases. This observability information could in turn be used for kubearmor policy generation.
The aim of this feature is to:

1. show observability data in context to pod/container. Observability data includes
   • process spawned in the pod/container
   • file system accesses made use of
   • capabilities accessed by the pods/containers
   • network primitives used by the pod/container
2. show the information at namespace level, pod level or at container level, across multi-node deployments

Some of the requirements/use-cases are documented in the slides here.

Describe the solution you'd like

A kubearmor coach service is deployed in the cluster. This service connects to the kubearmor relay and gets the events from the daemonsets. The events contain all the information required to show the observability information.

We would need command line tool to access observability information. karmor (kubearmor-client) tool could support karmor observe option.
We can further have a TUI tool built on top of these APIs using bubbletea.

The tasks can be divided into following phases:

• Phase 1: Design the expected sample output. KubeArmor Coach k8s-deployment+service ... keep the logs and records in the DB. Aggregate the logs and keep summarized information in the DB. Provide GRPC APIs to access the information. Extend karmor to support the observe option with filtering options.
• Phase 2: Work on TUI to show the output in easily consumable way.

[nthnieljson]

Hello, I have provided a design document draft regarding this feature
https://docs.google.com/document/d/177jR8CpC6OgqTA8sMyqXfaJitAvreN5XyO-NDm5UKcY/edit?usp=sharing

[Shubhf]

Hey @nyrahul Can I contribute on this issue?

[nyrahul]

Hey @Shubhf , I do not think this issue is relevant anymore since now have karmor profile that provides this view.
I think we can close this issue.

[Shubhf]

Thank you for your response ..Can u pls tell which issues can I work on ?

…

On Fri, 9 Aug 2024 at 1:00 AM, Rahul Jadhav ***@***.***> wrote: Hey @Shubhf <https://github.com/Shubhf> , I do not think this issue is relevant anymore since now have karmor profile that provides this view. I think we can close this issue. — Reply to this email directly, view it on GitHub <#613 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A5WMIMXPAOQZ7CQI2BNB5IDZQPBMJAVCNFSM6AAAAABMHA4HASVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENZWGUYTGNRYGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>