Skip to content
ugallu

ugallu

ugallu ugallu

ugallu is a Kubernetes-native security platform. Eleven operators share one versioned API surface (security.ugallu.io/v1alpha1) and one cosign-keyless supply chain, so detection, response and audit live in the same place your workloads do.

It is built first for Cilium-native clusters. Every operator works on any compliant CNI; on Cilium, the platform takes the higher-resolution path.

How ugallu uses Cilium

Section titled “How ugallu uses Cilium”

forensics freezes a suspect Pod with a deny-all CiliumNetworkPolicy, with egress carve-outs for DNS, the WORM evidence endpoint, and the forensics workload namespace. The expressive toEntities and toFQDNs selectors keep the freeze surgical - vanilla NetworkPolicy v1 fallback works, but it has to denylist via IP blocks rather than identities. The chart auto-detects the Cilium CRDs at install time and picks the backend; the choice surfaces on ForensicsConfig.status.freezeBackend.

tenant-escape reads CiliumNetworkPolicy as one of its inputs to the CrossTenantNetworkPolicy detector. On Cilium clusters that means catching identity-based egress crossing tenant boundaries; on vanilla CNI we fall back to label-based selection on NetworkPolicy v1.

dns-detect integrates with Tetragon (the Cilium project’s eBPF-based observability tool) as a fallback DNS source when the in-tree CoreDNS plugin can’t be deployed - useful on managed control planes.

seccomp-gen records syscall surface via the tetragon-bridge operator, which fans Tetragon FineGuidance events out to ugallu controllers as typed gRPC streams.

What ships

Section titled “What ships”

11 operators

audit-detection, dns-detect, tenant-escape, honeypot, webhook-auditor, forensics, seccomp-gen, backup-verify, compliance-scan, confidential-attestation - plus the resolver SDK and the tetragon-bridge.

Curated CRD surface

security.ugallu.io/v1alpha1: SecurityEvent, EventResponse, AttestationBundle, plus one *Run / *Result pair per operator. 16 ValidatingAdmissionPolicies guard the surface.

Cosign-keyless supply chain

Every image and every SE attestation bundle is signed via GitHub OIDC + Fulcio + Rekor. SBOM attached as a cosign attestation.

Helm umbrella

helm install ugallu charts/ugallu ships every operator, RBAC, admission policy, namespace and CRD. Published as a classic chart repo and an OCI mirror.

Get started

Section titled “Get started”
Quickstart Install on a Cilium + Tetragon cluster, deploy the umbrella chart, run the smoke suite.
Architecture Operator inventory, CRD surface, and the SDK runtime singletons.
Hardening Production switches: WORM Object Lock, attestor signing modes, OIDC, NetworkPolicy.
View on GitHub ninsun-labs/ugallu - monorepo, Apache-2.0, DCO required.

Status

Section titled “Status”

The project is pre-1.0. v0.1.0-alpha.1 is the first public release. Pre-v1.0.0 minor versions can break compat; breaking changes are called out at the top of every CHANGELOG entry.

Acknowledgments

Section titled “Acknowledgments”

ugallu stands on top of upstream projects without which it would not exist:

  • Cilium - identity-aware network policy and the CNI we target as the canonical platform. The ugallu reference deployment runs on Cilium.
  • CoreDNS - the in-cluster DNS resolver ugallu’s coredns-ugallu plugin extends with a gRPC stream of every query, the primary source for the dns-detect operator.
  • Tetragon - eBPF-based runtime observability; the source for the dns-detect kprobe fallback, tenant-escape exec detector, and seccomp-gen syscall recording.
  • Falco - runtime threat detection; one of the three backends the compliance-scan operator dispatches to, consumed via the Falco outputs gRPC API over mTLS.
  • Sigstore (Cosign + Fulcio + Rekor) - keyless signing and the transparency log behind every attestation bundle.
  • in-toto - the attestation statement format the attestor canonicalises before signing.
  • Velero - the backup engine backup-verify introspects.
  • Kubernetes SIG Auth
    • the audit log schema, the admission webhook contract, and the ValidatingAdmissionPolicy CEL surface that ugallu builds on.

ugallu is an independent open-source project under ninsun-labs. It is not affiliated with, endorsed by, or sponsored by the projects above or by the Cloud Native Computing Foundation.

License

Section titled “License”

Apache-2.0. DCO sign-off required on every commit.