> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt
> Use this file to discover all available pages before exploring further.

# eBPF security observability with Cilium Tetragon

> Real-time Kubernetes security observability with eBPF and Cilium Tetragon on CKS

This tutorial demonstrates how to use extended Berkeley Packet Filter (eBPF) with Cilium Tetragon on CoreWeave Kubernetes Service (CKS). This combination provides real-time Kubernetes security observability and runtime enforcement. By the end, you have Tetragon installed on a CKS cluster and an audit policy that monitors process execution. You also have a live stream of security events for auditing, compliance, and runtime threat detection. This guide is for cluster operators and security engineers who need visibility into container and process behavior on CKS.

## Background

CoreWeave reinforces network security and observability at multiple levels. These levels include programmable BlueField-3 data processing units (DPUs), container network interface (CNI) plugins such as Cilium with eBPF, and runtime tools such as Cilium Tetragon. This approach provides workload isolation, auditability, and real-time detection.

### Purpose

The configuration supports the following security goals:

* **Security observability**: When you configure Tetragon with eBPF, you gain insight into security events and anomalies within your Kubernetes clusters. Tetragon provides runtime visibility into container behavior. It can track specific system calls, such as `execve`, to create an auditable trail of process executions.
* **Auditing and compliance**: This setup helps you assess compliance with security policies by showing which operations run within your cluster.

## Prerequisites

Before you begin, make sure you have the following:

* A CoreWeave Kubernetes Service (CKS) cluster is in place.
* Helm is installed to manage Kubernetes packages.
* The [`jq`](https://jqlang.github.io/jq/download/) command-line processor is installed to filter JSON event logs.
* Linux kernel version 4.19 or later with BPF Type Format (BTF) support on your Nodes. For full functionality on Arm64, use kernel version 5.10 or later.

## Configuration steps

Configure Tetragon and its audit policy in the following stages.

### Add and install Tetragon through Helm

Tetragon provides the eBPF-based runtime monitoring agent that runs as a DaemonSet on every Node. Add the Cilium Helm chart repository and install Tetragon in your cluster's `kube-system` namespace.

```bash theme={"system"}
helm repo add cilium https://helm.cilium.io/
helm repo update
helm install tetragon cilium/tetragon \
  --namespace kube-system \
  --create-namespace
```

After the installation completes, Tetragon schedules Pods as a DaemonSet across your cluster Nodes.

### Verify the DaemonSet and logs

Before you apply policies, confirm Tetragon is running correctly.

```bash theme={"system"}
kubectl -n kube-system get pods -l app.kubernetes.io/name=tetragon
kubectl -n kube-system logs -l app.kubernetes.io/name=tetragon -c export-stdout --tail=20
```

After Tetragon is ready, the first command lists its running Pods, and the second command returns recent event-export logs.

### Enable audit policies

Audit policies specify which kernel events Tetragon observes. This example monitors process execution events so you can build an auditable trail of commands run inside your cluster.

1. Create an example policy file (for example, `exec-policy.yaml`):

   ```yaml title="exec-policy.yaml" theme={"system"}
   apiVersion: cilium.io/v1alpha1
   kind: TracingPolicy
   metadata:
     name: exec-audit
   spec:
     kprobes:
     - call: sys_execve
       syscall: true
       args:
       - index: 0
         type: string
   ```

2. Apply the policy:

   ```bash theme={"system"}
   kubectl apply -f exec-policy.yaml
   ```

### View security events

After you apply the policy, Tetragon emits an event each time a matching syscall occurs. Tetragon runs on every Node, so read events from the Tetragon Pod on the same Node as the monitored workload.

## Test the policy

Confirm that the `exec-audit` policy emits an event for a command in a test Pod:

1. Create a test Pod and wait for it to become ready:

   ```bash theme={"system"}
   kubectl run tetragon-exec-test \
     --image=busybox:1.36 \
     --restart=Never \
     --command -- sleep 300
   kubectl wait --for=condition=Ready pod/tetragon-exec-test --timeout=120s
   ```

2. Identify the Node that runs the test Pod and the Tetragon Pod on that Node:

   ```bash theme={"system"}
   TEST_NODE=$(kubectl get pod tetragon-exec-test -o jsonpath='{.spec.nodeName}')
   TETRAGON_POD=$(kubectl get pods -n kube-system \
     -l app.kubernetes.io/name=tetragon \
     --field-selector spec.nodeName="$TEST_NODE" \
     -o jsonpath='{.items[0].metadata.name}')
   ```

3. In the same terminal, stream events from the `export-stdout` container and filter for events from the `exec-audit` policy and test Pod:

   ```bash theme={"system"}
   kubectl logs -n kube-system "$TETRAGON_POD" \
     -c export-stdout \
     -f | jq -c 'select(
       .process_kprobe.policy_name == "exec-audit" and
       .process_kprobe.process.pod.name == "tetragon-exec-test" and
       .process_kprobe.args[0].string_arg == "/bin/ls"
     )'
   ```

4. In a second terminal, run a command in the test Pod:

   ```bash theme={"system"}
   kubectl exec tetragon-exec-test -- sh -c '/bin/ls'
   ```

   The first terminal displays a `process_kprobe` event with `policy_name` set to `exec-audit`. The event includes the command path, arguments, and Pod context.

5. Stop the log stream, then delete the test Pod:

   ```bash theme={"system"}
   kubectl delete pod tetragon-exec-test
   ```

## Customize policies

After the base policy works, you can scope monitoring to the events most relevant to your security posture. The example `exec-policy.yaml` monitors all process executions. You can create more targeted policies:

| Policy type              | Configuration              | Use case                                      |
| ------------------------ | -------------------------- | --------------------------------------------- |
| **Specific binaries**    | Add `path: "/usr/bin/apt"` | Track package installations                   |
| **Namespace filtering**  | Use `namespaceSelector`    | Limit monitoring scope to specific namespaces |
| **File access tracking** | Monitor `openat` syscalls  | Detect access to sensitive files              |
| **Network monitoring**   | Track `connect` syscalls   | Monitor network connections                   |

Tetragon loads eBPF programs into the Node kernel to provide runtime visibility into your workloads.