Tutorial: Sailing the Security Seas with Tetragon
summary
Hands-on walkthrough of Tetragon using the tetra CLI and an Instruqt single-node kind lab, installing via the Cilium Helm repo and relying on kernel BTF for symbol mapping. Shows detection of a vulnerable library being loaded — liblzma.so.5.6.0/5.6.1 — by SSH, demonstrates namespace-scoped tracing that SIGKILLs non‑RFC1918 TCP connects using a policy named connect-only-private-ADDRS, and catches a container escape via nsenter container escape, emitting structured JSON events that can feed SIEMs; demos largely succeed with minor lab hiccups.
AI-written summary · about
chapters (7)
- 0:00Tetragon and security observability
- 11:28XZ vulnerability with Tetragon
- 22:45Network policies with Tetragon namespaces
- 39:58Tetragon event data and context
- 51:20Detecting container escapes
- 1:03:48Unauthorized file writes at runtime
- 1:12:00Summary and Q&A
related talks
42mCoping with Zero Days with Cilium Tetragon
30mApplication network security and observability in an encrypted future
31meBPF-Driven Security for Kubernetes: The Tetragon Story
33mDetecting Compromised CI With eBPF and Cilium Tetragon
28mSimplifying the Networking and Security Stack With Cilium, Hubble, and Tetragon
44mCoping with Zero Days with Cilium Tetragon
06mWelcome + Opening Remarks- 44mCoping with Zero Days with Cilium Tetragon