eBPF-Driven Security for Kubernetes: The Tetragon Story
summary
Tetragon uses eBPF to hook into the kernel and capture every process, file and network event with microsecond granularity, writing events to eBPF maps for userland tools. It runs as a DaemonSet so it scales per node, not per pod, and the kernel verifier prevents unsafe programs. Provided tracing policies can enforce actions (example: sigkill on shell exec in a web container), installed via three Helm steps and validated on K3s with screenshots showing contextual pod/namespace metadata and immediate blocking behavior.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:32Kubernetes security focus
- 3:21Sidecar problem in Kubernetes
- 4:47Limitations of traditional tools
- 6:58Why the kernel is the right place for security
- 8:05eBPF kernel superpowers
- 9:06Sidecars vs eBPF monitoring
- 11:35Safe eBPF kernel programs
- 13:44eBPF maps and user-space tools
- 15:14Tetragon eBPF security tool
- 16:20Tetragon’s three personas
- 19:15Setting up Tetragon in Kubernetes
- 20:19Tetragon as watcher
- 20:40Tetragon as context provider
- 22:06Tetragon as enforcer
- 23:10Blocking attacks with policies
- 24:16Try Tetragon safely
- 24:41Conclusion
related talks
33meBPF for Security
36mSecuring the Superpowers: Who Loaded That EBPF Program?
36meBPF for Runtime Security
33mYou and Your Security Profiles; Generating Security Policies with the Help of eBPF
30mObservability in Kubernetes: Unlocking the Power of eBPF
30mApplication network security and observability in an encrypted future
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
32mReal Time Security - eBPF for Preventing attacks