This is unreleased documentation for Runtime Enforcer 0.10-dev.

Kubewarden Runtime Enforcer Learning Mode Configuration

Overview

You can configure Kubewarden Runtime Enforcer to operate in learning mode, allowing it to observe process executions in your workloads and learn the executable paths that run. Then, it creates or update a WorkloadPolicyProposal in the workload namespace with the list of observed executables.

Configuration Options

By default, Kubewarden Runtime Enforcer starts in learning mode for all namespaces:

learning:
  namespaceSelector:
    matchExpressions:
      - key: kubernetes.io/metadata.name
        operator: Exists

You can adjust this behaviour at install/upgrade time:

  • Disable behaviour learning entirely. Enforcement defined by WorkloadPolicy continues to work, but no new WorkloadPolicyProposal is generated:

    helm upgrade --install runtime-enforcer runtime-enforcer/runtime-enforcer \
  --namespace runtime-enforcer \
  --set-json 'learning.namespaceSelector={}'

  • Restrict learning to specific namespaces using a namespaceSelector:

    helm upgrade --install runtime-enforcer runtime-enforcer/runtime-enforcer \
  --namespace runtime-enforcer \
  --set-json 'learning.namespaceSelector={"matchLabels":{"env":"prod"}}'