Creating a KubeArmorSecurityPolicy

It’s time to create some policies! When KubeArmor is deployed, it creates three Custom Resource Definitions and one of those is kubearmorpolicies.security.kubearmor.com, which is used to create new policy resources.

Let’s jump right into an example policy. You do not need to deploy this to your cluster; it’s being used to show an example policy.

If we want to block any attempted access to create a file in the /bin directory of our containers in the demo namespace, the format of this policy is shown below:

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: block-write-bin
  namespace: demo
spec:
  action: Block
  file:
    matchDirectories:
    - dir: /bin/
      readOnly: true
      recursive: true
  message: Alert! An attempt to write to the /bin directory denied.

Breaking down this policy, we can see that it’s using the security.kubearmor.com/v1 API and it’s a KubeArmorPolicy...