Tetragon eBPF Runtime Enforcement Cheat Sheet

Updated 2026-03-17

Next Topic: Trivy Vulnerability Scanner Cheat Sheet

🧠Study flashcards on this topic126 cards · spaced repetition→

What This Cheat Sheet Covers

This topic spans 16 focused tables and 137 indexed concepts, 126 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Architecture and CNCF PositioningTable 2: TracingPolicy CRD StructureTable 3: Hook PointsTable 4: Selector FiltersTable 5: Enforcement Actions and ModesTable 6: Event Types and OutputTable 7: Kubernetes Identity-Aware PoliciesTable 8: Installation and DeploymentTable 9: Persistent Enforcement and Policy LifecycleTable 10: File System and Credential MonitoringTable 11: Network ObservabilityTable 12: Observability Policy LibraryTable 13: Performance and MetricsTable 14: SIEM and Alerting IntegrationsTable 15: Tetragon vs Falco Trade-offsTable 16: Troubleshooting and Diagnostics

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Architecture and CNCF Positioning

Before writing a single policy it pays to understand where Tetragon sits — a Cilium sub-project that runs eBPF programs directly inside the Linux kernel for security observability and runtime enforcement, with no kernel modules or patches. The rows here cover the moving parts you actually touch: the per-node DaemonSet, the BTF/CO-RE machinery that lets one binary span kernel versions, the tetra CLI, and the gRPC API everything talks to.

Concept	Example	Description
Tetragon Overview	Isovalent (Cisco 2024), CNCF sub-project of Cilium	• eBPF-based security observability and runtime enforcement tool • runs programs directly in the Linux kernel • no kernel patches or modules required
eBPF Foundation	`/sys/fs/bpf/tetragon` — pinned BPF maps	• Extended Berkeley Packet Filter lets sandboxed programs run in the Linux kernel • Tetragon uses eBPF for in-kernel filtering and enforcement without kernel/userspace boundary crossings
Architecture Components	tetragon DaemonSet + tetragon-operator Deployment	• Tetragon agent (DaemonSet) runs on every node • operator handles CRD lifecycle • BPF programs loaded per-node at startup and when policies are applied
CNCF Positioning	Cilium ecosystem: Tetragon for enforcement, Hubble for observability	• CNCF sandbox → incubating project under Cilium umbrella • integrates with Cilium for network policy and Hubble for network observability
Kernel Requirements	kernel 4.19 minimum; 5.8+ recommended for full BTF support	• BTF (BPF Type Format) required for CO-RE (Compile Once Run Everywhere) • without BTF, Tetragon uses pre-compiled probes for common kernels
BTF / CO-RE	`ls /sys/kernel/btf/vmlinux` to verify BTF presence	• CO-RE allows a single Tetragon binary to work across kernel versions • BTF provides kernel type information at runtime • check `CONFIG_DEBUG_INFO_BTF=y`
tetra CLI	`tetra getevents -o compact`	Command-line tool shipped with Tetragon for observing events, managing TracingPolicies, and controlling the daemon via gRPC
gRPC API	`unix:///var/run/tetragon/tetragon.sock`	• Primary API for event streaming and policy management • configure endpoint with `--server-address` • supports TLS for remote connections

Table 2: TracingPolicy CRD Structure

The TracingPolicy CRD is the heart of Tetragon — a single YAML document that declares what to observe and how to react. These rows walk the anatomy of that file from the top down: metadata and scope, the lists of hooks under spec, policy-level options like monitor versus enforce, and the reuse mechanisms (named lists, selector macros) that keep large policies from becoming unmanageable.

Concept	Example	Description
TracingPolicy CRD	`apiVersion: cilium.io/v1alpha1`, `kind: TracingPolicy`	• Kubernetes CRD defining what to observe and how to respond • loaded via `kubectl apply`, `tetra tracingpolicy add`, or `--tracing-policy` flag at daemon start

The rest of this section is part of the full cheat sheet

Table 3: Hook Points

A hook is where Tetragon attaches its eBPF program to the running kernel, and the choice matters: kprobes reach any kernel symbol but can break across versions, tracepoints are stable, and LSM hooks fire atomically before an operation proceeds. The rows compare every attachment type — kprobes, tracepoints, raw tracepoints, uprobes, USDTs, LSM BPF — plus the flags that govern argument access and return-value capture.

Concept	Example	Description
kprobes	`spec.kprobes[]: {call: "security_file_open", syscall: false}`	• Attach to any kernel symbol • dynamic, may break across kernel versions • list symbols in `/proc/kallsyms` • `syscall: true` for syscall wrappers

The rest of this section is part of the full cheat sheet

Table 4: Selector Filters

Selectors are what turn a noisy firehose into a precise signal — in-kernel filters that decide which events matter before they ever cross into userspace. Each match* clause narrows on a different dimension: argument values, return codes, binary and parent-binary paths, PIDs, namespaces, capabilities, and even namespace or capability changes that betray a container escape. Combine up to five and they AND together; stack multiple entries and they OR.

Concept	Example	Description
matchArgs	`matchArgs: [{index: 0, operator: "Equal", values: ["/etc/passwd"]}]`	• Filter by function argument values • `index` is 0-based • operators: Equal, NotEqual, Prefix, Postfix, Contains, GreaterThan, LessThan, Mask, InMap

The rest of this section is part of the full cheat sheet

Table 1: Architecture and CNCF Positioning

Concept	Example	Description
Tetragon Overview	Isovalent (Cisco 2024), CNCF sub-project of Cilium	• eBPF-based security observability and runtime enforcement tool • runs programs directly in the Linux kernel • no kernel patches or modules required
eBPF Foundation	`/sys/fs/bpf/tetragon` — pinned BPF maps	• Extended Berkeley Packet Filter lets sandboxed programs run in the Linux kernel • Tetragon uses eBPF for in-kernel filtering and enforcement without kernel/userspace boundary crossings
Architecture Components	tetragon DaemonSet + tetragon-operator Deployment	• Tetragon agent (DaemonSet) runs on every node • operator handles CRD lifecycle • BPF programs loaded per-node at startup and when policies are applied
CNCF Positioning	Cilium ecosystem: Tetragon for enforcement, Hubble for observability	• CNCF sandbox → incubating project under Cilium umbrella • integrates with Cilium for network policy and Hubble for network observability
Kernel Requirements	kernel 4.19 minimum; 5.8+ recommended for full BTF support	• BTF (BPF Type Format) required for CO-RE (Compile Once Run Everywhere) • without BTF, Tetragon uses pre-compiled probes for common kernels
BTF / CO-RE	`ls /sys/kernel/btf/vmlinux` to verify BTF presence	• CO-RE allows a single Tetragon binary to work across kernel versions • BTF provides kernel type information at runtime • check `CONFIG_DEBUG_INFO_BTF=y`
tetra CLI	`tetra getevents -o compact`	Command-line tool shipped with Tetragon for observing events, managing TracingPolicies, and controlling the daemon via gRPC
gRPC API	`unix:///var/run/tetragon/tetragon.sock`	• Primary API for event streaming and policy management • configure endpoint with `--server-address` • supports TLS for remote connections

Table 2: TracingPolicy CRD Structure

Concept	Example	Description
TracingPolicy CRD	`apiVersion: cilium.io/v1alpha1`, `kind: TracingPolicy`	• Kubernetes CRD defining what to observe and how to respond • loaded via `kubectl apply`, `tetra tracingpolicy add`, or `--tracing-policy` flag at daemon start

Table 3: Hook Points

Concept	Example	Description
kprobes	`spec.kprobes[]: {call: "security_file_open", syscall: false}`	• Attach to any kernel symbol • dynamic, may break across kernel versions • list symbols in `/proc/kallsyms` • `syscall: true` for syscall wrappers

Table 4: Selector Filters

Concept	Example	Description
matchArgs	`matchArgs: [{index: 0, operator: "Equal", values: ["/etc/passwd"]}]`	• Filter by function argument values • `index` is 0-based • operators: Equal, NotEqual, Prefix, Postfix, Contains, GreaterThan, LessThan, Mask, InMap