Keynote: Who Owns Your Pod? Observing and Blocking Unwanted Behavior at eBay With eBPF
Talkat KubeCon + CloudNativeCon China 2025 · on Wednesday, 2025-06-11· at 09:36· Level 16 | Grand Ballroom I·
summary
eBPF-based Tetragon is used at eBay to observe and enforce pod behavior in Kubernetes. The talk covers replacing Auditbeat by mapping its rules to Tetragon tracing policies (including identified gaps and upstream contributions) and using Tetragon to audit container process permissions to decide whether apps can move to stricter pod security policies. It also addresses deployment concerns like SIEM integration, resource use, and runtime enforcement of unwanted pod actions.
AI-written summary · about
related talks
31meBPF-Driven Security for Kubernetes: The Tetragon Story
30mObservability in Kubernetes: Unlocking the Power of eBPF
36mSecuring the Superpowers: Who Loaded That EBPF Program?
40mUsing the EBPF Superpowers To Generate Kubernetes Security Policies
33meBPF for Security
33mYou and Your Security Profiles; Generating Security Policies with the Help of eBPF
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
11mKeynote: Picture this! Solving Security Problems Visually with eBPF