Index / tool

Kguardian

Category: Cybersecurity
Rank: No. 1351Tools index
Previous survey · No. 1322 · 7 November 2026
Pricing: Open Source
Type: TOOL
Use case: Security & Identity
GitHub: 73 stars
Latest release: llm-bridge/v1.13.2
Date: Published Sep 30, 2026

About

Kguardian is a Kubernetes security tool that uses eBPF to observe workload behavior and auto-generate Network Policies and Seccomp Profiles from it. Profiles built from observed syscalls and traffic can be narrower than a runtime's default seccomp profile.

At a glance

kguardian observes Kubernetes pod traffic and system calls and turns those observations into draft network policies and seccomp allowlists. It is worth evaluating when you need to understand an existing workload before restricting what it can do.

Good fit

Platform teams that can exercise representative workloads in staging and review policy changes before enforcing them.

Consider something else when

If you cannot exercise rare operations such as restores or scheduled jobs, wait to enforce an allowlist derived from observed behavior.

Start here

Capture one staging workload through startup, normal requests and a background job. Generate a draft policy and check that it accounts for expected connections such as DNS and database access. Review would-deny results before enforcing it.

Cost and requirements

The project uses the Business Source License 1.1. Check the license for your deployment. The controller needs compatible Kubernetes nodes with eBPF support, and the broker stores observations in PostgreSQL.

Limits to know

A capture reflects the behavior exercised during that window. Missing traffic may break a legitimate path after enforcement, and observed traffic still needs review before you allow it.

Sources checked 2026-11-05. Source-based assessment.

Read the source review

What it does

Kguardian watches what each pod in a cluster actually does at the kernel level, which connections it opens and which system calls it makes, and stores that record in PostgreSQL. A kubectl plugin then turns the record into least-privilege firewall rules for pods (standard or Cilium flavour) and per-workload system-call allow-lists. It writes files for you to review and commit; it never applies anything to the cluster itself. A web UI maps the observed flows, and an optional assistant answers questions about them.

Why it's ranked here

The design choices are the case for it. Peer identity is stamped when a flow is captured, so a recycled pod IP cannot allow-list the wrong workload. An audit mode reports every flow a policy would deny without dropping a packet, so rules can be tested before enforcement. Output is plain YAML or JSON meant for review and GitOps. Against that, the Business Source License limits free use to development, testing, evaluation and non-production, non-commercial settings until it converts to Apache 2.0 on January 1, 2029.

What's good

The documentation is unusually candid about limits: it states that inbound UDP is not captured, that only a full syscall capture yields a profile safe to enforce, and exactly which fields the anonymous telemetry check-in sends, with a unit test pinning that list. The optional MCP endpoint is off by default, and the chart refuses to install it without a bearer token unless you opt out explicitly. Multiple broker replicas elect a leader through a Kubernetes Lease so background jobs do not run twice.

Tradeoffs

Requirements are narrow: Linux kernel 6.2 or newer on every node and containerd as the runtime, with Docker and CRI-O not supported. Inbound UDP is invisible, so DNS queries reaching CoreDNS never appear in the flow data. The broker API has authentication off by default. Telemetry is on by default, though it can be disabled. Syscall records are kept indefinitely. The docs disagree with themselves: the README says applying policies directly is not implemented, while the CLI reference still shows a generate-and-apply example. Production use needs a commercial license.

How to use it well

It fits platform and security teams on containerd clusters who want least-privilege network and seccomp policy without writing rules by hand, and who already review manifests through GitOps. Install the Helm chart, let workloads run long enough to build a baseline (the MCP guide suggests 5 to 15 minutes), generate per pod or namespace, and load rules as audit policies first. Turn telemetry off if needed. Check the license before running it in production; it is not a runtime threat detector or an enforcement engine.

Technical notes+

Per README.md and docs/architecture.mdx, the Controller is a Rust plus eBPF DaemonSet attaching fentry probes to tcp_v4_connect, tcp_set_state, udp_sendmsg and tcp_retransmit_skb, a kprobe/kretprobe pair on inet_csk_accept, the raw_syscalls/sys_enter tracepoint and tp_btf/cgroup_mkdir; the Broker is Rust on Actix-web with Diesel and PostgreSQL; the CLI and Evaluator are Go. docs/concepts/ebpf-monitoring.mdx confirms no UDP receive probe. broker/src/netpol/mod.rs ports the Go advisor generator, keys rules by peer IP plus identity, and pins output with shared golden fixtures. controller/src/main.rs moves registry wiring into seccomp_denial::wire_registry because main had no tests. docs/telemetry.mdx documents check_params_send_exactly_the_documented_fields; docs/cli/gen-networkpolicy.mdx shows --dry-run=false.

Observed

License: Business Source License 1.1, changing to Apache License 2.0 on the Change Date (see LICENSE)
Languages: Rust and eBPF C (controller, broker), Go (CLI, evaluator), TypeScript (web UI, LLM Bridge)
Install surface: Helm chart from an OCI registry plus a kubectl plugin
Interfaces: kubectl plugin CLI, web UI, broker HTTP API, optional MCP endpoint served by the LLM Bridge
Platform requirements: Kubernetes 1.19+, Linux kernel 6.2+, containerd only (Docker and CRI-O not supported)
Capture gap: Inbound UDP is not captured (docs/concepts/ebpf-monitoring.mdx)
Telemetry: Anonymous daily version check-in, enabled by default, disable with telemetry.enabled=false (docs/telemetry.mdx)

Read from README.md, LICENSE, docs/architecture.mdx, docs/installation.mdx, docs/concepts/ebpf-monitoring.mdx, docs/telemetry.mdx, docs/cli/gen-networkpolicy.mdx, controller/src/main.rs, broker/src/netpol/mod.rs, docs/guides/mcp-endpoint.mdx.

Comments (0)

No comments yet

Editorially curated, with community endorsements as a secondary signal. Corrections welcome.