tetragon

Project Overview

Tetragon is Cilium's eBPF-based Kubernetes-native security observability and runtime enforcement component. It detects and reacts to security-significant events such as process execution events, syscall activity, and I/O activity including network and file access. In Kubernetes environments, Tetragon understands Kubernetes identities like namespaces and pods, enabling security event detection to be configured in relation to individual workloads.

Key Features

• Process lifecycle observability: Generates process_exec and process_exit events by default
• Generic tracing: Supports process_kprobe, process_tracepoint, and process_uprobe events
• Network observability: Network traffic monitoring via kprobes
• Filename access monitoring: Tracks file access patterns
• Credentials monitoring: Monitors Linux process credentials
• Privileged execution detection: Detects and reports privileged execution

Target Audience

• Kubernetes security engineers and operators
• DevOps teams needing real-time security observability and enforcement
• Developers and researchers interested in eBPF technology

Quick Start

• Refer to the official Tetragon documentation
• Check the getting started guides for Kubernetes or Linux deployment
• Install the Tetra CLI for management

Core Advantages

• High-performance, low-overhead real-time monitoring with eBPF
• Kubernetes-native with deep container orchestration integration
• Open-source (Apache-2.0/BSD/GPL)

System Requirements

• OS: Linux (eBPF support required)
• Environment: Kubernetes (recommended) or Linux host