Skip to main content

Tetragon

eBPF-based security observability and runtime enforcement for Kubernetes.

Tetragon is a CNCF project from Cilium that uses eBPF to provide deep runtime security observability and enforcement at the kernel level. It can observe and filter system calls, network connections, file access, and process execution with near-zero overhead, and optionally enforce policies to block specific behaviors. It is used in this cluster for runtime security visibility — generating structured events for process execution, file access, and network activity that can be correlated with Kubernetes metadata.

Installation​

Architecture​

HelmRelease tetragon in namespace kube-system, chart from https://helm.cilium.io (same Helm repository as Cilium), version pinned via Renovate. Deployed as a DaemonSet. Prometheus ServiceMonitor enabled for both the tetragon agent and tetragon-operator. Talos-specific: extraHostPathMounts adds /sys/kernel/tracing to enable eBPF tracing (Talos mounts the tracefs at a non-standard path accessible only with explicit host mount).

Security​

Tetragon requires privileged access to load eBPF programs and read kernel tracing data. The DaemonSet runs with elevated privileges and hostPath mounts to /sys/kernel/tracing. This is inherent to the eBPF security model — Tetragon sits below the container runtime and monitors at the syscall level. TracingPolicy resources define what events to capture and can enforce blocking rules.

Updates​

Managed by Renovate. The chart version is semver-pinned in the HelmRelease.

Usage​

Tetragon emits structured JSON events (process execution, file access, network connections) annotated with Kubernetes pod/namespace metadata. Events can be consumed via the tetra CLI, Prometheus metrics, or forwarded to a SIEM. TracingPolicy CRDs allow defining eBPF-level policies — for example, blocking a process from accessing sensitive files or making unexpected network connections. Monitoring dashboards use the Prometheus metrics exposed via ServiceMonitor.

Cluster-specific deviations from the above live in the per-cluster README — see k8s/platform/tetragon/talos/README.md.

Cluster Deployment​

Tetragon — Talos cluster

Kubernetes Metadata
Rendered manifests (kustomize build)
apiVersion: v1
data:
  values.yaml: |
    # metrics are scraped annotation-based by vmagent — no ServiceMonitor CRDs
    podAnnotations:
      prometheus.io/scrape: "true"
      prometheus.io/port: "2112"
    tetragon:
      prometheus:
        enabled: true
        serviceMonitor:
          enabled: false
      # default export ships every process_exec/process_exit cluster-wide
      # (~22M rows/day into VictoriaLogs) with no TracingPolicy consuming
      # them — only export events produced by explicit policies.
      exportAllowList: |-
        {"event_set":["PROCESS_KPROBE", "PROCESS_TRACEPOINT", "PROCESS_LSM", "PROCESS_UPROBE"]}
    tetragonOperator:
      podAnnotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "2113"
      prometheus:
        enabled: true
        serviceMonitor:
          enabled: false

    # required for talos
    extraHostPathMounts:
      - name: sys-kernel-tracing
        mountPath: /sys/kernel/tracing
kind: ConfigMap
metadata:
  name: tetragon-values-624m6tf489
  namespace: kube-system