One Policy To Rule Them All? Scaling Tetragon Without Flooding Your Cluster
summary
SUSE adapts Tetragon to enforce a per-workload security model and removes wasteful BPF preallocation that costs about 3 MB saved per unused policy, which multiplies across 100–200 policies per node. Changes add CLI flags to opt out of preallocation, fix kernel feature detection for SLES, close a file-descriptor leak, and cut 116 source lines with a macro. Work in progress proposes a deduplicated policy mode to avoid redeploying the same policy hundreds of times.
AI-written summary · about
chapters (10)
- 0:00Tetragon scaling challenges
- 3:16Policy memory optimization
- 7:313MB saved per policy
- 10:26BPF map memory control
- 11:53Kernel compatibility for policies
- 13:17Probe multi-function leaks
- 14:40eBPF macro cleanup
- 16:27Policy deduplication architecture
- 18:54Community collaboration
- 20:06Q&A
related talks
01h 12mTutorial: Sailing the Security Seas with Tetragon
31meBPF-Driven Security for Kubernetes: The Tetragon Story
33meBPF for Security
29mSimplifying the Networking and Secur...
16meBPF for Creating Least Privileged Policies; What Do I Need to Know to Prepare for the Next CVEs?
30mApplication network security and observability in an encrypted future
33mYou and Your Security Profiles; Generating Security Policies with the Help of eBPF
44mCoping with Zero Days with Cilium Tetragon