eBPF security observability with Cilium Tetragon

This tutorial demonstrates how to use extended Berkeley Packet Filter (eBPF) with Cilium Tetragon on CoreWeave Kubernetes Service (CKS). This combination provides real-time Kubernetes security observability and runtime enforcement. By the end, you have Tetragon installed on a CKS cluster and an audit policy that monitors process execution. You also have a live stream of security events for auditing, compliance, and runtime threat detection. This guide is for cluster operators and security engineers who need visibility into container and process behavior on CKS.

Background

CoreWeave reinforces network security and observability at multiple levels. These levels include programmable BlueField-3 data processing units (DPUs), container network interface (CNI) plugins such as Cilium with eBPF, and runtime tools such as Cilium Tetragon. This approach provides workload isolation, auditability, and real-time detection.

Purpose

The configuration supports the following security goals:

Security observability: When you configure Tetragon with eBPF, you gain insight into security events and anomalies within your Kubernetes clusters. Tetragon provides runtime visibility into container behavior. It can track specific system calls, such as execve, to create an auditable trail of process executions.
Auditing and compliance: This setup helps you assess compliance with security policies by showing which operations run within your cluster.

Prerequisites

Before you begin, make sure you have the following:

A CoreWeave Kubernetes Service (CKS) cluster is in place.
Helm is installed to manage Kubernetes packages.
The jq command-line processor is installed to filter JSON event logs.
Linux kernel version 4.19 or later with BPF Type Format (BTF) support on your Nodes. For full functionality on Arm64, use kernel version 5.10 or later.

Configuration steps

Configure Tetragon and its audit policy in the following stages.

Add and install Tetragon through Helm

Tetragon provides the eBPF-based runtime monitoring agent that runs as a DaemonSet on every Node. Add the Cilium Helm chart repository and install Tetragon in your cluster’s kube-system namespace.

helm repo add cilium https://helm.cilium.io/
helm repo update
helm install tetragon cilium/tetragon \
  --namespace kube-system \
  --create-namespace

After the installation completes, Tetragon schedules Pods as a DaemonSet across your cluster Nodes.

Verify the DaemonSet and logs

Before you apply policies, confirm Tetragon is running correctly.

kubectl -n kube-system get pods -l app.kubernetes.io/name=tetragon
kubectl -n kube-system logs -l app.kubernetes.io/name=tetragon -c export-stdout --tail=20

After Tetragon is ready, the first command lists its running Pods, and the second command returns recent event-export logs.

Enable audit policies

Audit policies specify which kernel events Tetragon observes. This example monitors process execution events so you can build an auditable trail of commands run inside your cluster.

Create an example policy file (for example, exec-policy.yaml):

exec-policy.yaml

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: exec-audit
spec:
  kprobes:
  - call: sys_execve
    syscall: true
    args:
    - index: 0
      type: string

Apply the policy:
kubectl apply -f exec-policy.yaml

View security events

After you apply the policy, Tetragon emits an event each time a matching syscall occurs. Tetragon runs on every Node, so read events from the Tetragon Pod on the same Node as the monitored workload.

Test the policy

Confirm that the exec-audit policy emits an event for a command in a test Pod:

Create a test Pod and wait for it to become ready:

kubectl run tetragon-exec-test \
  --image=busybox:1.36 \
  --restart=Never \
  --command -- sleep 300
kubectl wait --for=condition=Ready pod/tetragon-exec-test --timeout=120s

Identify the Node that runs the test Pod and the Tetragon Pod on that Node:

TEST_NODE=$(kubectl get pod tetragon-exec-test -o jsonpath='{.spec.nodeName}')
TETRAGON_POD=$(kubectl get pods -n kube-system \
  -l app.kubernetes.io/name=tetragon \
  --field-selector spec.nodeName="$TEST_NODE" \
  -o jsonpath='{.items[0].metadata.name}')

In the same terminal, stream events from the export-stdout container and filter for events from the exec-audit policy and test Pod:

kubectl logs -n kube-system "$TETRAGON_POD" \
  -c export-stdout \
  -f | jq -c 'select(
    .process_kprobe.policy_name == "exec-audit" and
    .process_kprobe.process.pod.name == "tetragon-exec-test" and
    .process_kprobe.args[0].string_arg == "/bin/ls"
  )'

In a second terminal, run a command in the test Pod:
kubectl exec tetragon-exec-test -- sh -c '/bin/ls'
The first terminal displays a process_kprobe event with policy_name set to exec-audit. The event includes the command path, arguments, and Pod context.
Stop the log stream, then delete the test Pod:
kubectl delete pod tetragon-exec-test

Customize policies

After the base policy works, you can scope monitoring to the events most relevant to your security posture. The example exec-policy.yaml monitors all process executions. You can create more targeted policies:

Policy type	Configuration	Use case
Specific binaries	Add `path: "/usr/bin/apt"`	Track package installations
Namespace filtering	Use `namespaceSelector`	Limit monitoring scope to specific namespaces
File access tracking	Monitor `openat` syscalls	Detect access to sensitive files
Network monitoring	Track `connect` syscalls	Monitor network connections

Tetragon loads eBPF programs into the Node kernel to provide runtime visibility into your workloads.

​Background

​Purpose

​Prerequisites

​Configuration steps

​Add and install Tetragon through Helm

​Verify the DaemonSet and logs

​Enable audit policies

​View security events

​Test the policy

​Customize policies