⚠️

Warning

The Cast AI Kubernetes Security feature set is undergoing significant changes. Some features shown in this documentation are being deprecated and others are moving to the cluster view in the console. Screenshots and navigation paths may not reflect the current product. Updated documentation is in progress.

Kvisor is Cast AI's open-source cluster observability agent. It collects network traffic flows, resource usage statistics, GPU metrics, and storage data that powers Cast AI's monitoring and cost features. When security features are enabled, Kvisor additionally performs image vulnerability scanning, Kubernetes manifest linting, and runtime security monitoring.

As an open-source component, you can review its implementation on GitHub.

What is Kvisor?

Kvisor operates as both a Kubernetes controller (Deployment) and an agent (DaemonSet). The controller reconciles cluster state and schedules assessment jobs; the agent runs on each node to collect real-time telemetry.

The agent is lightweight and minimally invasive. By default it runs in a read-only observability mode — security features are opt-in additions to this baseline.

Key capabilities

Network traffic monitoring

Kvisor collects Kubernetes network flows using eBPF. This data powers Cast AI's network cost monitoring feature, giving you visibility into pod-to-pod and pod-to-external traffic patterns across IPv4 and IPv6.

Resource metrics

Kvisor collects storage utilization, Pressure Stall Information (PSI) metrics, and CPU/memory/I/O usage statistics from containers and nodes. This data surfaces in the Cast AI console's Node list and powers reliability metrics.

GPU metrics

On clusters with NVIDIA GPUs, Kvisor collects GPU utilization data via DCGM Exporter. This powers Cast AI's GPU utilization monitoring feature.

Cluster proxy

When enabled, the Kvisor controller exposes a cluster proxy that allows Cast AI's OpsPilot to fetch container logs directly from your cluster for troubleshooting.

Container image vulnerability scanning (optional)

When enabled, Kvisor scans container images running in your cluster against known vulnerability databases. It evaluates both public and private registries and provides severity assessments based on CVSS scores. The scanner checks against:

• Center for Internet Security (CIS) Kubernetes Benchmark
• National Security Agency (NSA) Kubernetes Hardening Guidelines
• Open Web Application Security Project (OWASP) recommendations
• Payment Card Industry Data Security Standard (PCI DSS) requirements

Kubernetes compliance assessment (optional)

When enabled, Kvisor evaluates your Kubernetes environment against industry best practices and CIS Benchmarks, identifying misconfigurations and validating RBAC settings.

Runtime security monitoring (optional)

When enabled, Kvisor deploys eBPF programs to detect anomalous activities in real time — unusual network connections, potentially malicious processes, and suspicious file system operations.

Architecture

Kvisor operates with a two-component architecture:

1. Kvisor Controller (Deployment): Communicates with the Cast AI control plane, reconciles cluster state, and schedules scanning jobs.

2. Kvisor Agent (DaemonSet): Runs on every node to collect real-time telemetry. Required for netflow monitoring, resource metrics, GPU metrics, and runtime security.

Permissions

For detailed information about the permissions Kvisor requires, see Kubernetes permissions.

Extended system permissions

Some optional features require additional system-level privileges.

Kube-bench configuration validation

The Kvisor Controller schedules castai-kube-bench jobs to validate kubelet and other system components against CIS Benchmarks. These jobs require elevated privileges to access system configuration files.

Required privileges:

• HostPID access

Read-only host mounts:

• /var/lib/kubelet
• /etc/systemd
• /etc/kubernetes
• /home/kubernetes

Runtime security monitoring

When runtime security is enabled, the Kvisor Agent deploys eBPF programs that require additional Linux capabilities.

Linux capabilities:

• SYS_ADMIN
• SYS_PTRACE
• SYS_RESOURCE
• NET_ADMIN
• BPF
• PERFMON
• IPC_LOCK
• SYSLOG

Read-only host mounts:

• /etc/os-release
• /sys/kernel/debug
• /sys/fs/cgroup
• /run/containerd/containerd.sock

Next steps

For detailed installation and configuration instructions, see Installing and Upgrading Kvisor.

To learn how to scan private container registries, see Private Image Scanning.