Runtime-Enforcer Learning Mode Configuration

Overview

You can configure runtime-enforcer to operate in learning mode, allowing it to observe process executions in your workloads and learn the executable paths that run. Then, it creates or update a WorkloadPolicyProposal in the workload namespace with the list of observed executables.

Configuration Options

By default, Runtime-Enforcer starts in learning mode for all namespaces:

learning:
  namespaceSelector:
    matchExpressions:
      - key: kubernetes.io/metadata.name
        operator: Exists

You can adjust this behaviour at install/upgrade time:

  • Disable behaviour learning entirely. Enforcement defined by WorkloadPolicy continues to work, but no new WorkloadPolicyProposal is generated:

    helm upgrade --install runtime-enforcer runtime-enforcer/runtime-enforcer \
  --namespace runtime-enforcer \
  --set-json 'learning.namespaceSelector={}'

  • Restrict learning to specific namespaces using a namespaceSelector:

    helm upgrade --install runtime-enforcer runtime-enforcer/runtime-enforcer \
  --namespace runtime-enforcer \
  --set-json 'learning.namespaceSelector={"matchLabels":{"env":"prod"}}'