Securing the Superpowers: Who Loaded That EBPF Program?
summary
Tetragon provides an eBPF auditing and enforcement pipeline that hooks the BPF verifier to capture every program load and map creation with Kubernetes metadata, program type, and instruction-level details. The system copies instructions out (≈4KB) for post‑hoc integrity checks, logs map names and key/value types, and integrates with Cilium for node‑level visibility. Policies can block unauthorized loads by killing the process synchronously in‑kernel, and demos on a one‑node k8s cluster show live events for program loads and map creations working end‑to‑end.
AI-written summary · about
chapters (11)
- 0:00Securing eBPF programs
- 4:43Why auditing eBPF matters
- 5:26Tetragon architecture
- 7:52eBPF program structure
- 11:19Monitoring via verifier hook
- 14:52Auditing eBPF loads
- 17:40Expected vs unexpected loads
- 21:15Detecting malicious eBPF
- 23:23Live demo: eBPF auditing with Tetragon
- 32:22Summary and eBPF security future
- 34:32Q&A on Tetragon
related talks
43meBPF Superpowers for SRE
31meBPF-Driven Security for Kubernetes: The Tetragon Story
36meBPF for Runtime Security
40mUsing the EBPF Superpowers To Generate Kubernetes Security Policies
33mYou and Your Security Profiles; Generating Security Policies with the Help of eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
30mObservability in Kubernetes: Unlocking the Power of eBPF
32mExploring the Power of eBPF for System Observability