Kerno

What it does

Deployment

Kerno can run as a Kubernetes DaemonSet or as a binary on bare metal, VMs, EC2, and GCE; Docker images are published for Linux amd64 and arm64.checked 8 Oct 2001

Diagnosis rules

The engine evaluates 11 deterministic rules covering issues such as disk I/O bottlenecks, OOM events, TCP retransmits, scheduler contention, and file descriptor leaks.checked 8 Oct 2001

Incident reports

The `kerno doctor` command collects 30 seconds of kernel data and returns ranked findings with causes, evidence, ETAs, and suggested fixes.checked 8 Oct 2001

Integrations

The project lists Prometheus metrics and ServiceMonitor support, Kubernetes pod enrichment, optional Anthropic, OpenAI, and Ollama providers, and systemd enrichment.checked 8 Oct 2001

Kernel requirement

The quick start requires Linux kernel 5.8 or later with BTF; Helm or raw manifest deployment requires cluster-admin.checked 8 Oct 2001

License

The repository identifies Kerno as licensed under Apache License 2.0.checked 8 Oct 2001

Monitoring

Its watch commands cover TCP connections and retransmits, OOM kills, and file descriptor leak detection.checked 8 Oct 2001

Network policy limitation

The README cautions that standard Kubernetes NetworkPolicy resources generally do not restrict Kerno because it uses host networking, unless host-firewall configuration is used.checked 8 Oct 2001

Permissions

The documented Kubernetes security posture lists CAP_BPF, CAP_PERFMON, CAP_SYS_PTRACE, CAP_NET_ADMIN, and CAP_DAC_READ_SEARCH, and says the hot path does not require CAP_SYS_ADMIN.checked 8 Oct 2001

Privilege requirement

Kerno needs elevated privileges or documented Linux capabilities to load eBPF programs into the kernel.checked 8 Oct 2001

Purpose

Kerno is an eBPF-based incident diagnosis engine for production issues across Linux, Kubernetes, VMs, and bare metal.checked 8 Oct 2001

Requirements

Kubernetes use requires Linux kernel 5.8 or later with BTF, and raw manifests or Helm installation require cluster-admin access.checked 8 Oct 2001

Roadmap limits

The roadmap lists OpenTelemetry export and Grafana dashboards for v0.2, Slack and PagerDuty integrations for v0.3, and a managed Optiqor Cloud offering for v1.0.checked 8 Oct 2001

Security

The project says Kerno makes no outbound network calls by default and that AI integration is opt-in through the configured provider.checked 8 Oct 2001

Security details

The security policy says Kerno's eBPF programs are read-only observers and that it does not log file contents, environment variables, authentication tokens, or network payloads.checked 8 Oct 2001

Security posture

The README says Kerno makes no outbound network calls by default and that AI integration is opt-in through a configured provider.checked 8 Oct 2001

Support

The security policy directs general questions to GitHub Discussions and vulnerability reports to [email protected], with acknowledgment targeted within 48 hours.checked 8 Oct 2001

Tracing

Kerno supports syscall latency, disk I/O latency, and CPU scheduler delay tracing.checked 8 Oct 2001