Tetragon: eBPF Security Observability for Kubernetes

What is Tetragon?

Tetragon is Cilium's component for eBPF-based security observability, paired with runtime enforcement, run on Linux hosts or inside a Kubernetes cluster. It hooks into critical kernel points through sensors, emitting events such as process_exec, process_exit, process_kprobe, process_tracepoint, and process_uprobe, each carrying Linux and Kubernetes context like namespace and pod.

Core Capabilities

• ✓By default, Tetragon emits process_exec and process_exit events, covering the full process lifecycle without any policy configuration.
• ✓Generic tracing events — process_kprobe, process_tracepoint, and process_uprobe — support custom detection logic defined through TracingPolicy resources.
• ✓Kubernetes-aware: it understands namespaces, pods, and other cluster identities, so detection can target specific workloads.
• ✓Covers system call activity and I/O, including network and file access, not just process starts and stops.
• ✓Documented use cases beyond the basics: network observability, filename access tracking, Linux credentials monitoring, and privileged execution detection.
• ✓Ships alongside the Tetra CLI, installed separately, for interacting with Tetragon.

Practical Security Scenarios

• •Watching process execution across a cluster to catch a shell spawned inside a container that shouldn't be running one.
• •Writing a TracingPolicy to flag specific system calls or kernel probes for a workload you don't fully trust.
• •Tracking privileged execution or credential changes inside containers, per the README's linked use case pages.
• •Auditing file access and network activity tied to a specific namespace or pod, instead of raw host-level logs.

Getting Started with Tetragon

The README doesn't list install commands inline; it points to the official Tetragon documentation instead. From there the getting-started guides split by target: install Tetragon on a Kubernetes cluster, try it on Linux via Docker, deploy Tetragon more broadly, or install the separate Tetra CLI for interacting with it. Treat those docs pages as the source of truth for exact commands, since none appear in this repo's README.

Configuring Security Policies

Beyond the default process_exec/process_exit events, custom detection goes through TracingPolicy resources — that's the mechanism the README points to for configuring process_kprobe, process_tracepoint, and process_uprobe events. The README links dedicated use-case pages for network observability, filename access, Linux process credentials, and privileged execution, all built on that same TracingPolicy concept rather than a separate config format. Exact policy syntax isn't in this repo's README; it's covered in the linked TracingPolicy concept page and the use-case docs.

Comparing Runtime Security Tools

Frequently Asked Questions

The problem it solves

Most security tooling watches network traffic or reads audit logs afterward, so a shell spawned inside a compromised pod, or a suspicious file read inside a container, can go unnoticed until someone digs through logs later. Tetragon closes that gap by hooking directly into the kernel and reacting as those events happen — process execution, system call activity, and network or file access — with Kubernetes identity attached so the specific workload is obvious right in the alert.

Who should try it — and who should skip

Try Tetragon if you run workloads on Kubernetes or Linux and want kernel-level visibility into process execution, syscalls, and file or network access, tied to pod and namespace identity rather than raw host logs. It's also a fit if you're prepared to write TracingPolicy resources to go beyond the default process-lifecycle events. Skip it if you just want network policy enforcement — that's Cilium's job — or if you need a turnkey install with no policy authoring at all.

Related repositories