Merge branch 'kubearmor-incubation' of https://github.com/kubearmor/KubeArmor into kubearmor-incubation

.github/workflows/ci-merge-coverage.yaml

@@ -6,11 +6,16 @@ on:
     types:
       - completed
 
+permissions: {}
+
 jobs:
   merge-coverage-files:
     name: Download and merge files
     runs-on: ubuntu-latest
     timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
     steps:
       - name: Check if all required workflows completed successfully
         id: check-workflows
@@ -47,10 +52,10 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: true
-          
+
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version-file: 'KubeArmor/go.mod'
+          go-version-file: "KubeArmor/go.mod"
 
       - name: Download k8s coverage files from ci-test-ginkgo
         if: ${{ env.ci-test-ginkgo_status == 'success' }}
@@ -64,4 +69,4 @@ jobs:
 
       - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/ci-stable-release.yml

@@ -15,6 +15,8 @@ jobs:
     if: github.repository == 'kubearmor/kubearmor'
     runs-on: ubuntu-22.04
     timeout-minutes: 60
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
@@ -59,7 +61,6 @@ jobs:
           STABLE_VERSION=`cat STABLE-RELEASE`
           gh release create --repo kubearmor/charts $STABLE_VERSION --generate-notes
 
-
   update-helm-chart:
     name: Update KubeArmor Helm chart version
     if: github.repository == 'kubearmor/kubearmor'

.github/workflows/renovate.yml

@@ -11,6 +11,7 @@ on:
         default: "info"
         type: string
 
+permissions: {}
 concurrency:
   group: renovate
   cancel-in-progress: false

CONTRIBUTING.md

@@ -4,17 +4,17 @@ Welcome to KubeArmor, and thank you for showcasing your interest in contributing
 
 _As contributors and maintainers of this project, and in the interest of fostering an open and welcoming community, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities._
 
-Since, KubeArmor is part of the Kubernetes Community, we request you to also go through the following:
+Since KubeArmor is part of the Kubernetes community, we request you to also go through the following:
 
 - [Kubernetes Contributor Guide](https://www.kubernetes.dev/docs/guide/): Main contributor documentation.
 - [Contributor Cheat Sheet](https://github.com/kubernetes/community/blob/master/contributors/guide/contributor-cheatsheet/README.md): Common resources for existing developers.
 
 ## Getting Started
 
-If you are new to the project or open source contributions in general, we encourage you to start by familiarizing yourself with KubeArmor via our KubeArmor Overview [Wiki](https://docs.kubearmor.io/kubearmor/quick-links/kubearmor_overview).
+If you are new to the project or open-source contributions in general, we encourage you to start by familiarizing yourself with KubeArmor via our KubeArmor Overview [wiki](https://docs.kubearmor.io/kubearmor/quick-links/kubearmor_overview).
 
 We maintain a list of curated issues that are great entry points:
-- [Good First Issues](https://github.com/kubearmor/KubeArmor/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22): Ideal for Beginners or new comers.
+- [Good First Issues](https://github.com/kubearmor/KubeArmor/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22): Ideal for beginners or newcomers.
 - [Help Wanted Issues](https://github.com/kubearmor/KubeArmor/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22): Issues that need additional input, expertise, or effort from the community. Suitable for contributors who are ready to take on slightly more involved tasks.
 - [Backlog Issues](https://github.com/kubearmor/KubeArmor/issues?q=is%3Aissue+is%3Aopen+label%3Abacklog): Issues that are planned or pending implementation. These are great for contributors looking for meaningful and scoped technical work.
 
@@ -69,7 +69,6 @@ Test coverage is crucial for the stability and maintainability of the project. W
 
 KubeArmor is dedicated to supporting contributors at all levels. Here’s how you can grow within the community:
 
-
 ### Join Mentorship Programs
 You can contribute to KubeArmor through several open source mentorship programs:
 - **[Google Summer of Code (GSoC)](https://summerofcode.withgoogle.com/)**: Contribute to well-defined projects under the mentorship of KubeArmor maintainers. GSoC typically runs in summer and is supported by CNCF.
@@ -97,7 +96,6 @@ If you have any questions or need help while contributing:
 - **Community Meetings**: Attend our regular meetings listed in our [GitHub README](https://github.com/kubearmor/KubeArmor#community).
 - **GitHub Discussions**: Use [GitHub Discussions](https://github.com/kubearmor/KubeArmor/discussions) for long-form questions and ideas.
 - **Documentation**: Refer to KubeArmor [Docs](https://docs.kubearmor.io/) for in-depth information.
-- **FAQs**: Common queries and tips can be found in our README [FAQ Section](https://github.com/kubearmor/KubeArmor#frequently-asked-questions).
+- FAQs: Common queries and tips can be found in our README [FAQ section](https://github.com/kubearmor/KubeArmor#frequently-asked-questions).
 
 We look forward to your valuable contributions. Thank you for being part of the KubeArmor community!
-

GOVERNANCE.md

@@ -164,6 +164,7 @@ Changes to `GOVERNANCE.md` are made by pull request and require a structural (tw
 
 ## Licenses and the DCO
 
+The following licenses and contributor agreements apply to KubeArmor:
 The following licenses and contributor agreements apply to KubeArmor:
 
 - [Apache License 2.0](https://opensource.org/licenses/Apache-2.0) for code.

SECURITY.md

@@ -5,7 +5,7 @@ The KubeArmor community has adopted the below security disclosures and response
 Please do not report security vulnerabilities through public GitHub issues.
 
 ## Security bulletins
-For information regarding the security of this project please join our [slack channel](https://join.slack.com/t/kubearmor/shared_invite/zt-2bhlgoxw1-WTLMm_ica8PIhhNBNr2GfA).
+For information regarding the security of this project please join our [Slack channel](https://join.slack.com/t/kubearmor/shared_invite/zt-2bhlgoxw1-WTLMm_ica8PIhhNBNr2GfA).
 
 ## Reporting a Vulnerability
 ### When you should?
@@ -14,7 +14,7 @@ For information regarding the security of this project please join our [slack ch
 - You think you discovered a vulnerability in the dependency of KubeArmor. For those projects, please leverage their reporting policy.
 
 ### When you should not?
-- You need assistance in configuring KubeArmor for security - please discuss this is in the [slack channel](https://cloud-native.slack.com/archives/C07EF44HWQM)
+- You need assistance in configuring KubeArmor for security - please discuss this in the [Slack channel](https://cloud-native.slack.com/archives/C07EF44HWQM)
 - You need help applying security-related updates.
 - Your issue is not security-related.
 
@@ -30,7 +30,7 @@ For information regarding the security of this project please join our [slack ch
         * Proof-of-concept or exploit code (if possible)
         * Impact of the issue, including how an attacker might exploit the issue
 
-    * These information will help us triage your report more quickly.
+    * This information will help us triage your report more quickly.
 
 2. The project security team will send an initial response to the disclosure in 3-5 days. Once the vulnerability and fix are confirmed, the team will plan to release the fix in 7 to 28 days based on the severity and complexity.
 

getting-started/FAQ.md

@@ -8,15 +8,15 @@
 
 <details><summary><h4>I am applying a blocking policy but it is not blocking the action. What can I check?</h4></summary>
 
-### Checkout Binary Path
+### Check Binary Path
 If the path in your process rule is not an absolute path but a symlink, policy enforcement won't work. This is because KubeArmor sees the actual executable path in events received from kernel space and is not aware about symlinks.
 
 Policy enforcement on symbolic links like `/usr/bin/python` doesn't work and one has to specify the path of the actual executable that they link to.
 
-### Checkout Platform Support
-Check `karmor probe` output and check whether `Container Security` is false. If it is false, the KubeArmor enforcement is not supported on that platform. You should check the [KubeArmor Support Matrix](support_matrix.md) and if the platform is not listed there then raise a new issue or connect to kubearmor community of [slack](https://cloud-native.slack.com/archives/C07EF44HWQM).
+### Check Platform Support
+Check `karmor probe` output and check whether `Container Security` is false. If it is false, the KubeArmor enforcement is not supported on that platform. You should check the [KubeArmor Support Matrix](support_matrix.md) and if the platform is not listed there then raise a new issue or connect to the KubeArmor community on [Slack](https://cloud-native.slack.com/archives/C07EF44HWQM).
 
-### Checkout Default Posture
+### Check Default Posture
 If you are applying an Allow-based policies and expecting unknown actions to be blocked, please make sure to check the [default security posture](default_posture.md). The default security posture is set to Audit by default since KubeArmor v0.7.
 
 </details>
@@ -24,8 +24,8 @@ If you are applying an Allow-based policies and expecting unknown actions to be
 <details><summary><h4>How is KubeArmor different from PodSecurityPolicy/PodSecurityContext?</h4></summary>
 
 Native k8s supports specifying a security context for the pod or container. It requires one to specify native AppArmor, SELinux, seccomp policies. But there are a few problems with this approach:
-* All the OS distributions do not support the LSMs consistently. For e.g, [GKE COS](https://cloud.google.com/container-optimized-os/) supports AppArmor while [Bottlerocket](https://aws.amazon.com/bottlerocket/) supports SELinux and BPF-LSM.
-* The Pod Security Context expect the security profile to be specified in its native language, for instance, AppArmor profile for AppArmor. SELinux profile if SELinux is to be used. The profile language is extremely complex and this complexity could backfire i.e, it could lead to security holes.
+* All the OS distributions do not support the LSMs consistently. For example, [GKE COS](https://cloud.google.com/container-optimized-os/) supports AppArmor while [Bottlerocket](https://aws.amazon.com/bottlerocket/) supports SELinux and BPF-LSM.
+* The Pod Security Context expects the security profile to be specified in its native language, for instance, AppArmor profile for AppArmor. SELinux profile if SELinux is to be used. The profile language is extremely complex and this complexity could backfire i.e, it could lead to security holes.
 * Security Profile updates are manual and difficult: When an app is updated, the security posture might change and it becomes difficult to manually update the native rules.
 * No alerting of LSM violation on managed cloud platforms: By default LSMs send logs to kernel auditd, which is not available on most managed cloud platforms.
 
@@ -34,8 +34,8 @@ KubeArmor solves all the above mentioned problems.
 * It's easy to deploy: KubeArmor is deployed as a daemonset. Even when the application is updated, the enforcement rules are automatically applied.
 * Consistent Alerting: KubeArmor handles kernel events and maps k8s metadata using ebpf.
 * KubeArmor also runs in systemd mode so can directly run and protect Virtual Machines or Bare-metal machines too.
-* Pod Security Context cannot leverage BPF-LSM at all today. BPF-LSM provides more programmatic control over the policy rules.
-* Pod Security Context do not manage abstractions. As an example, you might have two nodes with Ubuntu, two nodes with Bottlerocket. Ubuntu, by default has AppArmor and Bottlerocket has BPF-LSM and SELinux. KubeArmor internally picks the right primitives to use for enforcement and the user do not have to bother explicitly stating what to use.
+* Pod Security Contexts cannot leverage BPF-LSM at all today. BPF-LSM provides more programmatic control over the policy rules.
+* Pod Security Contexts do not manage abstractions. As an example, you might have two nodes with Ubuntu, two nodes with Bottlerocket. Ubuntu, by default has AppArmor and Bottlerocket has BPF-LSM and SELinux. KubeArmor internally picks the right primitives to use for enforcement and the user does not have to bother explicitly stating what to use.
 </details>
 
 <details><summary><h4>What is visibility that I hear of in KubeArmor and how to get visibility information?</h4></summary>