Application network security and observability in an encrypted future
summary
Tetragon runs L7 parsing and enforcement entirely in-kernel, using BPF parsers attached via sockmap hooks to capture DNS, TLS handshakes and then transition to HTTP parsing so plaintext is visible before kTLS encrypts it. The claim is this preserves observability and policy enforcement without trusting containers or using uprobes or sidecars. Implementation details include pushing Kubernetes metadata and socket state into the kernel; ktls offload keeps performance low and benchmarks are forthcoming.
AI-written summary · about
chapters (10)
- 0:00Introduction and overview
- 1:08What is Tetragon
- 6:27Network visibility with Tetragon
- 10:04Trust model and boundaries
- 13:32L7 parsing with sock map
- 19:18Challenge of encrypted traffic
- 23:05TLS termination vs ktls
- 26:39Demo and parser details
- 27:45BPF capabilities and limitations
- 29:55Q&A and closing
related talks
31meBPF-Driven Security for Kubernetes: The Tetragon Story
33meBPF for Security
01h 12mTutorial: Sailing the Security Seas with Tetragon
24mRuntime Security: Challenges & Solution Space
32mReal Time Security - eBPF for Preventing attacks
39mLeveraging the Linux Kernel for Building a Zero-Trust Environment With...
36meBPF for Runtime Security
33mYou and Your Security Profiles; Generating Security Policies with the Help of eBPF