forked from kubearmor/KubeArmor
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* explicits states what k8s platforms are supported * kubearmor's support for different distributions for VM/bare-metals. * Updated deployment guide to link to the support matrix * updated go.sum Ref: kubearmor#647 Signed-off-by: Rahul Jadhav <[email protected]> Signed-off-by: Rahul Jadhav <[email protected]>
- Loading branch information
Showing
3 changed files
with
46 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| # KubeArmor Support Matrix | ||
|
|
||
| KubeArmor supports following types of workloads: | ||
| 1. K8s orchestrated workloads: Workloads deployed as k8s orchestrated containers. In this case, Kubearmor is deployed as a [k8s daemonset](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/). Note, KubeArmor supports policy enforcement on both k8s-pods ([KubeArmorPolicy](https://github.com/kubearmor/KubeArmor/blob/main/getting-started/security_policy_specification.md)) as well as k8s-nodes ([KubeArmorHostPolicy](https://github.com/kubearmor/KubeArmor/blob/main/getting-started/host_security_policy_specification.md)). | ||
| 2. VM/Bare-Metals workloads: Workloads deployed on Virtual Machines or Bare Metal i.e. workloads directly operating as host processes. In this case, Kubearmor is deployed in [systemd mode](kubearmor_vm.md). | ||
|
|
||
| ## K8s support matrix | ||
| | Kubernetes Engine | OS Image | Support | Remarks | | ||
| |-------------------|-----------|-----------|---------| | ||
| | [Google GKE](https://cloud.google.com/kubernetes-engine) | [Container Optimized OS](https://cloud.google.com/container-optimized-os/docs/concepts/features-and-benefits) | Yes | Supported across Stable/Regular/Rapid/ release channels | | ||
| | [Google GKE](https://cloud.google.com/kubernetes-engine) | Ubuntu | Yes | Supported across Stable/Regular/Rapid/ release channels | | ||
| | [Microsoft Azure](https://azure.microsoft.com/) | Ubuntu | Yes | | ||
| | [AWS EKS](https://aws.amazon.com/eks/) | Amazon Linux 2 | Partial | Observability/Audit mode is supported, Enforcement node is supported for nodes/hosts only (not for k8s pods). | | ||
| | [AWS EKS](https://aws.amazon.com/eks/) | Ubuntu | Yes | | ||
| | RedHat OpenShift | * | TBD | | ||
| | VMWare Tanzu | * | TBD | | ||
| | Rancher RKE | * | TBD | | ||
|
|
||
| ### When will EKS with Amazon Linux 2 be supported? | ||
|
|
||
| Amazon Linux 2 currently is shipped with SELinux as the LSM (Linux Security Module). KubeArmor supports SELinux only for host-based policy enforcement. On Amazon Linux 2, Kubearmor currently supports observability/policy audits using ebpf based engine. | ||
|
|
||
| The latest versions of Amazon Linux 2 ship with a new LSM type called BPF-LSM and Kubearmor [intends](https://github.com/kubearmor/KubeArmor/issues/484) to support it soon). | ||
|
|
||
| ### Platform I am interested is not listed here! What can I do? | ||
|
|
||
| Please approach the Kubearmor community on [slack](https://github.com/kubearmor/kubearmor#slack) or [raise](https://github.com/kubearmor/KubeArmor/issues/new/choose) a GitHub issue to express interest in adding the support. | ||
|
|
||
| It would be very much appreciated if you can test kubearmor on a platform not listed above and if you have access to. Once tested you can update this document and raise a PR, if possible. | ||
|
|
||
| ### What local K8s platforms are supported? | ||
|
|
||
| [Minikube](../contribution/minikube), [K3s](../deployments/k3s) and [Microk8s](../contribution/microk8s) platforms are currently supported. | ||
|
|
||
| ## VM/Bare-Metal support | ||
|
|
||
| | Provider | Distro | Support | | ||
| |----------|--------|---------| | ||
| | SUSE | SUSE Enterprise 15 | Yes | | ||
| | Debian | [Buster](https://www.debian.org/releases/buster/) / [Bullseye](https://www.debian.org/releases/bullseye/) | Yes | | ||
| | Ubuntu | 18.04 / 20.04 | Yes | | ||
| | RedHat | RHEL8.4 / RHEL 9 | Yes | | ||
| | CentOS | CentOS8.4 / CentOS 9 | Yes | | ||
| | Fedora | Fedora 34 / 35 | Yes | |