Is agentless security a solid solution for managing Kubernetes workloads?

Not totally sure what "agentful security" means, though. Could you give some examples? It’s not a term I've come across often.

eBPF can definitely help here! But remember, its effectiveness really depends on how much effort and resources you put into maintaining it. Just deploying tools like tetragon or falco without ongoing management is usually just checking a compliance box.

Agentless solutions are great for tasks like static analysis and vulnerability scanning. You can scan images in your registries and gain visibility through Kubernetes APIs. However, you might miss out on some in-depth monitoring and attack detection capabilities. A mixed approach often works best for many organizations; use agentless for vulnerability management and a lightweight runtime protection where it’s essential.

Absolutely, agentless security can work well at scale! We've been using it across over 300 clusters for more than two years, and honestly, the performance is so much better than when we had agents installed. We don’t deal with image bloat or constant pod restarts anymore. By scanning from outside the runtime, it’s cleaner and more efficient. Orca is a great tool for this too, as it doesn’t tax performance at all.

Yeah, there are different ways to approach this. We focus on three main steps: registering for scanning, scanning during the CI/CD pipeline, and deploying agents as a DaemonSet for VM and security monitoring. This way, we avoid making changes to the containers themselves. We've found success with Twistlock by Prisma Cloud.