Implementing Runtime Security With Tetragon

Implementing Runtime Security with Tetragon

Overview

Tetragon is a CNCF project under Cilium that provides flexible Kubernetes-aware security observability and runtime enforcement using eBPF. By operating at the Linux kernel level, Tetragon can monitor and enforce policies on process execution, file access, network connections, and system calls with less than 1% performance overhead -- far more efficient than traditional user-space security agents.

When to Use

• When deploying or configuring implementing runtime security with tetragon capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Common Misconfigurations & Verification

A TracingPolicy that loads cleanly can still be observe-only or never fire. Validate enforcement, not just installation:

• Observe-only when you meant to block: a selector with only matchActions: [{action: Post}] emits an event but lets the syscall through. Enforcement requires Sigkill, Signal, or Override - and Override needs a kernel that supports bpf_override_return (CONFIG_BPF_KPROBE_OVERRIDE / fexit/fmod_ret).
• Selectors too narrow: matchBinaries keyed on absolute paths (/usr/bin/xmrig) is trivially bypassed by copying the binary; prefer matching on the operation (security_bprm_check, setns, security_file_open) plus namespace context.
• Namespace scoping inverted: matchNamespaces with In/NotIn host_ns is the usual escape-detection logic - get the operator backwards and you alert on the host instead of containers.
• Silent drops: tetragon_missed_events_total > 0 means the ring buffer overflowed and events were lost - your detection has gaps.

Verify: trigger the exact behavior in a throwaway pod (e.g. cat /etc/shadow, nsenter, run a renamed miner) and confirm the event in tetra getevents -o compact and that a Sigkill policy actually killed the process (echo $? / pod restart). Check kubectl get tracingpolicy shows the policy loaded on every node, not just the one you tested.

Prerequisites

• Kubernetes cluster v1.24+ with Helm 3.x installed
• Linux kernel 5.4+ (5.10+ recommended for full eBPF feature support)
• kubectl access with cluster-admin privileges
• Familiarity with eBPF concepts and Kubernetes security primitives

Core Concepts

eBPF-Based Security

Tetragon attaches eBPF programs directly to kernel functions, enabling:

• Process lifecycle tracking: Monitor every process creation, execution, and termination across all pods
• File integrity monitoring: Detect unauthorized reads/writes to sensitive files
• Network observability: Track all TCP/UDP connections with full pod context
• System call filtering: Enforce policies on dangerous syscalls like ptrace, mount, or unshare

TracingPolicy Custom Resources

Tetragon uses TracingPolicy CRDs to define what kernel events to observe and what actions to take:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: detect-privilege-escalation
spec:
  kprobes:
    - call: "security_bprm_check"
      syscall: false
      args:
        - index: 0
          type: "linux_binprm"
      selectors:
        - matchBinaries:
            - operator: "In"
              values:
                - "/bin/su"
                - "/usr/bin/sudo"
                - "/usr/bin/passwd"
          matchNamespaces:
            - namespace: Pid
              operator: NotIn
              values:
                - "host_ns"
          matchActions:
            - action: Post

Enforcement Actions

Tetragon can take three types of actions directly in the kernel:

1. Sigkill: Immediately terminate the offending process
2. Signal: Send a configurable signal to the process
3. Override: Override the return value of a kernel function to deny an operation

Installation and Configuration

Step 1: Install Tetragon with Helm

helm repo add cilium https://helm.cilium.io
helm repo update

helm install tetragon cilium/tetragon \
  --namespace kube-system \
  --set tetragon.enableProcessCred=true \
  --set tetragon.enableProcessNs=true \
  --set tetragon.grpc.address="localhost:54321"

Step 2: Install the Tetragon CLI

GOOS=$(go env GOOS)
GOARCH=$(go env GOARCH)
curl -L --remote-name-all \
  https://github.com/cilium/tetragon/releases/latest/download/tetra-${GOOS}-${GOARCH}.tar.gz
tar -xzvf tetra-${GOOS}-${GOARCH}.tar.gz
sudo install tetra /usr/local/bin/

Step 3: Verify Installation

kubectl get pods -n kube-system -l app.kubernetes.io/name=tetragon
tetra status

Practical Implementation

Detecting Container Escape Attempts

Create a TracingPolicy to detect processes attempting to escape container namespaces:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: detect-container-escape
spec:
  kprobes:
    - call: "__x64_sys_setns"
      syscall: true
      args:
        - index: 0
          type: "int"
        - index: 1
          type: "int"
      selectors:
        - matchNamespaces:
            - namespace: Pid
              operator: NotIn
              values:
                - "host_ns"
          matchActions:
            - action: Sigkill

Monitoring Sensitive File Access

Detect reads of sensitive credentials:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: monitor-sensitive-files
spec:
  kprobes:
    - call: "security_file_open"
      syscall: false
      args:
        - index: 0
          type: "file"
      selectors:
        - matchArgs:
            - index: 0
              operator: "Prefix"
              values:
                - "/etc/shadow"
                - "/etc/kubernetes/pki"
                - "/var/run/secrets/kubernetes.io"
          matchActions:
            - action: Post

Blocking Crypto-Miner Execution

Prevent known crypto-mining binaries from executing:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: block-cryptominers
spec:
  kprobes:
    - call: "security_bprm_check"
      syscall: false
      args:
        - index: 0
          type: "linux_binprm"
      selectors:
        - matchBinaries:
            - operator: "In"
              values:
                - "/usr/bin/xmrig"
                - "/tmp/xmrig"
                - "/usr/bin/minerd"
          matchActions:
            - action: Sigkill

Observing Events with Tetra CLI

Stream runtime events in real-time:

# Watch all process execution events
kubectl exec -n kube-system ds/tetragon -c tetragon -- \
  tetra getevents -o compact --process-only

# Filter events for a specific namespace
kubectl exec -n kube-system ds/tetragon -c tetragon -- \
  tetra getevents -o compact --namespace production

# Export events in JSON for SIEM integration
kubectl exec -n kube-system ds/tetragon -c tetragon -- \
  tetra getevents -o json | tee /var/log/tetragon-events.json

Integration with SIEM and Alerting

Export to Elasticsearch

# tetragon-helm-values.yaml
export:
  stdout:
    enabledCommand: true
    enabledArgs: true
  filenames:
    - /var/log/tetragon/tetragon.log
  elasticsearch:
    enabled: true
    url: "https://elasticsearch.monitoring:9200"
    index: "tetragon-events"

Prometheus Metrics

Tetragon exposes metrics at :2112/metrics:

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: tetragon-metrics
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: tetragon
  endpoints:
    - port: metrics
      interval: 15s

Key Metrics and Alerts

References

• Tetragon Official Documentation
• Cilium Tetragon GitHub Repository
• CNCF Tetragon Project Page
• eBPF Security Observability with Tetragon - CoreWeave
• Kubernetes Security: eBPF & Tetragon for Runtime Monitoring