iochia02/bpfima repository overview

⁠The BPFIMA framework

BPFIMA is a cloud-native security framework that combines the deep observability of eBPF with the hardware-anchored trust of traditional Linux Integrity Measurement Architecture (IMA). It enables administrators to enforce cryptographically verifiable, privacy-preserving runtime attestation across dynamic Kubernetes clusters. It is based on a kernel module, eBPF programs and an user space tool

⁠Docker Image

This multi-architecture (x86_64 and ARM64) Docker image serves as both the runtime execution environment and the dynamic builder for the BPFIMA framework. It contains the components to build, install, and configure the framework on a Linux node (Fedora, Ubuntu, or Debian) equipped with a TPM 2.0.

⁠Helm Chart

The Helm chart provides an automated deployment model by provisioning:

• DaemonSet: schedules the BPFIMA agents across all eligible worker nodes to ensure cluster-wide security coverage.
• Policy CRD: extends the Kubernetes API, allowing administrators to configure granular event filtering, targeted cgroup/path tracking, and LSM hook toggles via standard YAML manifests.
• RBAC & automated cleanup: establishes a secure ServiceAccount and ClusterRole for the Policy custom operator. It also includes specific lifecycle hooks that safely unload the kernel module and unpin eBPF maps during uninstallation, leaving zero residual state on the host.

⁠Quick Start

To deploy the framework to your cluster, install the Helm chart directly from this registry:

helm install bpfima oci://registry-1.docker.io/iochia02/bpfima \
    --version 0.1.0 \
    --namespace bpfima-system \
    --create-namespace

For advanced configuration parameters (such as targeting specific TPM PCR indexes), detailed policy examples, and source code, please refer to the official BPFIMA GitHub Repository⁠.