Securing CI/CD Systems Through eBPF
summary
Builds an eBPF agent (Go) using Tetragon to monitor CI runners, injectable into GitHub Actions via a privileged container, and demonstrates stopping SolarWinds-style source replacement and the Codecov bash exfiltration by enforcing code integrity checks (deny writes to .go files) and allowlisting domains (resolve to IPs, kill out-of-list TCP connects). Agent streams events to a lab server, works in demos, and needs better DNS handling and CI-specific step policies before production.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:39Agenda
- 1:47Alexs background
- 2:24What is eBPF
- 3:39eBPF tooling
- 4:59Securing CICD
- 7:45Why eBPF
- 8:44SolarWinds
- 12:04Installation of malicious dependencies
- 13:36Tetragon
- 14:51Architecture
- 15:54Functionality
- 16:55Installation
- 17:36GitHub Action
- 18:10Tracing
- 19:21Deep Inspection
- 20:12Integrity
- 20:53Code Integrity
- 21:11Network Protection
- 21:28Network Protection Implementation
- 22:10Demos
- 28:50Whats next
- 30:50Open Source
- 31:31Conclusion
- 32:32Questions
related talks
20mSecuring CI/CD Runners Through eBPF
30mSecuring CI/CD Runners Through eBPF Agent
33mDetecting Compromised CI With eBPF and Cilium Tetragon
27mVerifiable eBPF Traces for Supply Chain Artifacts with Witness and Tetragon
31meBPF-Driven Security for Kubernetes: The Tetragon Story
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
28mSee It to Believe It: Bringing Observability to Otherwise ...