Extending Kubernetes policy enforcement to runtime security for AI workloads
Nirmata published an open source project, Nirmata Runtime for Kyverno, that uses eBPF and Linux Security Modules to enforce policy on process execution, file access, network egress, and application protocol inside running pods. Policies use the same CEL-based syntax as Kyverno admission policies and start in monitor mode, with denials attributed to the responsible policy and reported as OpenReports objects. The post describes example policies for AI agent pods, such as limiting egress to an LLM gateway, restricting launchable binaries, and detecting agent CLIs in images.
What changes for platform teams
Platform teams running agent pods could use per-pod runtime policies to restrict egress, executables, and credential file access beyond what admission control checks. The post provides no benchmarks, adoption data, or independent validation, so the enforcement claims are unverified.
Read the original at CNCF Blog ↗
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules