KubeArmor

Tetragon is a Kubernetes-aware security observability and runtime enforcement tool developed as a Cilium sub-project and CNCF project. It uses eBPF and Linux kernel security mechanisms to monitor processes, system calls, file access, network activity, namespace changes and privilege changes, correlating events with workload and network identity. Its policy engine performs monitoring, filtering and enforcement in the kernel, including controls such as restricting binary execution, detecting Kubernetes data exfiltration and monitoring file integrity. Tetragon exposes event data through JSON logs and a gRPC endpoint, and can be installed on Kubernetes with Helm, on Linux from released packages, or as a container.

Kata Containers is an open-source container runtime and project that runs workloads inside lightweight virtual machines, combining a container-like interface with the workload isolation and security properties of virtual machines. Its core runtime integrates with container managers through a containerd shim v2 implementation; an agent inside each virtual machine or pod sets up the container environment, while a hypervisor provides the virtualized boundary. The project supports multiple virtualization technologies and architectures, uses a configuration file covering the runtime, agent, and hypervisor, and includes a host-capability check through the `kata-runtime check` command. The code is licensed under Apache 2.0.

kern is a fast, rootless OCI container runtime, sandbox, and virtual resource runtime distributed as a small static binary without a daemon. It creates kernel-enforced containers from OCI images, using user, PID, mount, network, UTS, and IPC namespaces, overlay or read-only roots, a deny-by-default seccomp allowlist, and cgroup v2 limits; the `--security-profile untrusted` option applies the documented hardened bundle. It can also attach named CPU, memory, disk, and device profiles from `kern.toml` to containers, or apply resource caps directly to host processes with optional Landlock write confinement. The project supports container operations, Dockerfile builds, image pull/push and save/load, stack execution through its own or Docker Compose format, and includes Python and Node SDKs plus an MCP server for agents. Its Rust dependency tree uses libc, while image pulling delegates to system `curl` and `tar`; it runs natively on Linux, requires WSL2 on Windows, and needs a Linux virtual machine on macOS.

KubeRay is a platform for running Ray workloads within Kubernetes clusters. In the described DatologyAI pipeline, it was used with Ray and vLLM to orchestrate large-scale synthetic-data jobs on EKS on HyperPod.

Kbomb is a Kubernetes cluster inventory tool that reports cluster configuration and running workloads, with container-image scanning included as part of the report.