Verifying and Signing EBPF Programs with Inspektor Gadget
summary
Inspektor Gadget packages eBPF programs as OCI images and signs them in CI with cosign, then verifies signatures at runtime and refuses execution of images whose signature or payload digest does not match. It supports multiarch images, pushes signatures and payloads to the registry via ORAS/OCI APIs, and accepts multiple public keys set at deploy time for Kubernetes. It targets risks from helpers like bpf_override_return and shows blocking unsigned gadgets, while noting runtime-generated eBPF bytecode remains out of scope.
AI-written summary · about
chapters (8)
- 0:00eBPF and Inspektor Gadget intro
- 3:58eBPF security challenges
- 6:50What is Inspektor Gadget
- 9:15OCI images for eBPF
- 11:46Signing Gadgets with Cosign
- 13:52Verification in Kubernetes
- 16:25Conclusion and future
- 17:30Q&A
related talks
40mUsing the EBPF Superpowers To Generate Kubernetes Security Policies
25mDiscussion: What's next for BPF Signing
36mSecuring the Superpowers: Who Loaded That EBPF Program?
20mDebugging Kubernetes and Container Workloads with the Superpower of eBPF
29meBPF on the Rise - Getting Started
36meBPF for Runtime Security
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
43meBPF Superpowers for SRE