This tutorial demonstrates how to use extended Berkeley Packet Filter (eBPF) with Cilium Tetragon for real-time security observability and runtime enforcement within Kubernetes on CoreWeave Kubernetes Service (CKS). By the end, you have Tetragon installed on a CKS cluster, an audit policy applied to monitor process execution, and a live stream of security events you can use for auditing, compliance, and runtime threat detection. This guide is for cluster operators and security engineers who need visibility into container and process behavior on CKS.
Background
CoreWeave reinforces network security and observability at multiple levels: programmable hardware (BlueField-3 DPUs), CNI plugins like Cilium (with eBPF), and runtime tools such as Cilium Tetragon for process-level enforcement and monitoring. This approach provides workload isolation, auditability, and real-time detection without the performance overhead of virtualized environments.
Purpose
- Security observability: When you configure Tetragon with eBPF, you gain insight into security events and anomalies within your Kubernetes clusters. Tetragon provides runtime visibility into container behavior and can track specific system calls, such as
execve, to provide an auditable trail of process executions.
- Auditing and compliance: This setup helps you ensure compliance with security policies by showing which operations run within your cluster, which strengthens your security posture.
Prerequisites
- A CoreWeave Kubernetes Service (CKS) cluster is in place.
- Helm is installed to manage Kubernetes packages.
- Cilium is installed on your CKS cluster (installed by default).
- Tetragon version 0.11 or newer.
- Linux kernel version 5.8 or later on your Nodes (required for Tetragon support).
Configuration steps
Add and install Tetragon through Helm
Tetragon provides the eBPF-based runtime monitoring agent that runs as a DaemonSet on every Node. Add the Cilium Helm chart repository and install Tetragon in your cluster’s kube-system namespace.
helm repo add cilium https://helm.cilium.io/
helm repo update
helm install tetragon cilium/tetragon \
--namespace kube-system \
--create-namespace
Verify the DaemonSet and logs
Before you apply policies, confirm Tetragon is running correctly.
kubectl -n kube-system get pods -l app.kubernetes.io/name=tetragon
kubectl -n kube-system logs -l app.kubernetes.io/name=tetragon
Enable audit policies
Audit policies specify which kernel events Tetragon observes. This example monitors process execution events so you can build an auditable trail of commands run inside your cluster.
-
Create an example policy file (for example,
exec-policy.yaml):
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
name: exec-audit
spec:
kprobes:
- call: execve
syscall: true
args:
- index: 0
type: string
returnArg: true
-
Apply the policy:
kubectl apply -f exec-policy.yaml
View security events
After you apply the policy, Tetragon emits an event each time a matching syscall occurs. Stream Tetragon audits and alerts in real time:
kubectl logs -n kube-system -l app.kubernetes.io/name=tetragon -f
Test the policy
Confirm that policy events reach the log stream by generating activity that the policy captures:
# Run a simple command that triggers exec events
kubectl exec -n kube-system -it deployment/coredns -- /bin/sh -c "ls"
# Check if the event appears in Tetragon logs
kubectl logs -n kube-system -l app.kubernetes.io/name=tetragon --tail=20
execve syscall details, including the command path, arguments, and container context.
Customize policies
After the base policy works, you can scope monitoring to the events most relevant to your security posture. The example exec-policy.yaml monitors all process executions. You can create more targeted policies:
| Policy type | Configuration | Use case |
|---|
| Specific binaries | Add path: "/usr/bin/apt" | Track package installations |
| Namespace filtering | Use namespaceSelector | Limit monitoring scope to specific namespaces |
| File access tracking | Monitor openat syscalls | Detect access to sensitive files |
| Network monitoring | Track connect syscalls | Monitor network connections |
Last modified on June 10, 2026
