Security Overview
kprobe observes production systems at the kernel layer, so its security model must be explicit.
The recorder requires elevated host permissions to load eBPF programs and read kernel event buffers. kprobe limits that access to passive observation and exposes configuration controls for data collection, retention, authentication, and access.
Security goals
- collect only the kernel and metadata needed for incident forensics
- avoid application payload capture by default
- isolate recorder, pipeline, API, and console permissions
- support private deployment and SSO
- expose audit and health signals
- make privileged access visible and reviewable
Main controls
| Control | Purpose |
|---|---|
| RBAC | Limits Kubernetes permissions. |
| Agent capabilities | Grants only the host access needed for eBPF capture. |
| Namespace filters | Restricts observed workloads. |
| Retention policies | Limits how long high-resolution event data is stored. |
| Authentication | Controls API and console access. |
| Audit logs | Records administrative access and configuration changes. |