eBPF for Security
summary
eBPF instruments the kernel to collect Kubernetes-aware security events (openSnoop/Hubble/Cilium) and compare them to policies; Cilium’s Tetragon uses kernel heuristics to map processes to pods, filters events in-kernel (example: watch /etc and only emit matches), and can kill processes synchronously from the kernel to prevent writes. LSM hooks landed in Linux 5.7 so this approach is safe there, while Tetragon also supports older kernels via other stable kernel probes. LSM hooks Tetragon
AI-written summary · about
chapters (8)
- 0:00Introduction to eBPF
- 1:48Fundamentals of kernel events
- 6:28Observability in Kubernetes
- 11:31Security observability challenges
- 16:03Leveraging LSM for security
- 22:18Introduction to Tetragon
- 25:46Preventative security actions
- 30:36Conclusion and resources
related talks
31meBPF-Driven Security for Kubernetes: The Tetragon Story
36meBPF for Runtime Security
32mReal Time Security - eBPF for Preventing attacks
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
33mYou and Your Security Profiles; Generating Security Policies with the Help of eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
30mObservability in Kubernetes: Unlocking the Power of eBPF
46mThe eBPF Revolution: A Dynamic Linux Kernel