kubewarden/runtime-enforcer

Kubewarden Runtime Enforcer is a Kubernetes security tool that enforces process execution policies at the kernel level using eBPF.

The tool addresses the challenge of controlling which processes can run inside Kubernetes workloads by observing and restricting process execution through kernel-level enforcement. It operates in three distinct phases: Learn mode observes process executions and generates policy proposals per workload; Monitor mode reports policy violations without blocking them; Protect mode actively blocks executions that violate the approved allow-list. This phased approach lets operators understand workload behavior before enforcing restrictions.

Adoption requires Kubernetes 1.31 or later with containerd or CRI-O runtime configured with NRI enabled, plus specific kernel and architecture compatibility. The tool is deployed via Helm chart and depends on cert-manager and cert-manager-csi-driver. It includes a bundled OpenTelemetry collector for violation metrics and events, eliminating the need for external observability infrastructure in basic setups. The project is in Beta, so users should review the design documents and compatibility matrix before deployment. This approach suits teams seeking kernel-level process enforcement without external policy engines, particularly those already invested in the Kubewarden ecosystem.

Development activity shows consistent engagement with the project. The team maintains comprehensive documentation including quick-start guides, compatibility matrices, and detailed phase explanations. Configuration is exposed through a well-structured Helm values file with clear separation of concerns across controller, agent, debugger, learning, telemetry, and scheduling components. The project preserves CRD lifecycle through Helm annotations, indicating attention to operational concerns around upgrades and resource management.