Implements eBPF-based runtime security in Kubernetes using Cilium Tetragon for threat detection, process/file/network monitoring, and policy enforcement via TracingPolicies.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
Tetragon 是 Cilium 旗下的一个 CNCF 项目，使用 eBPF 提供灵活的 Kubernetes 感知型安全可观测性和运行时执行机制。Tetragon 在 Linux 内核层运行，能够以不到 1% 的性能开销监控和执行进程执行、文件访问、网络连接和系统调用策略——远比传统用户态安全代理高效。
Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for threat detection and policy enforcement.
Implements eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement.
Detects container escape attempts using Falco runtime security rules in Kubernetes or Docker, monitoring syscalls, host filesystem mounts, nsenter, and privileged containers.
Share bugs, ideas, or general feedback.
Tetragon 是 Cilium 旗下的一个 CNCF 项目，使用 eBPF 提供灵活的 Kubernetes 感知型安全可观测性和运行时执行机制。Tetragon 在 Linux 内核层运行，能够以不到 1% 的性能开销监控和执行进程执行、文件访问、网络连接和系统调用策略——远比传统用户态安全代理高效。
Tetragon 将 eBPF 程序直接挂载到内核函数，可实现：
Tetragon 使用 TracingPolicy CRD 定义要观测的内核事件及响应操作：
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
name: detect-privilege-escalation
spec:
kprobes:
- call: "security_bprm_check"
syscall: false
args:
- index: 0
type: "linux_binprm"
selectors:
- matchBinaries:
- operator: "In"
values:
- "/bin/su"
- "/usr/bin/sudo"
- "/usr/bin/passwd"
matchNamespaces:
- namespace: Pid
operator: NotIn
values:
- "host_ns"
matchActions:
- action: Post
Tetragon 可直接在内核中执行三种类型的动作：
helm repo add cilium https://helm.cilium.io
helm repo update
helm install tetragon cilium/tetragon \
--namespace kube-system \
--set tetragon.enableProcessCred=true \
--set tetragon.enableProcessNs=true \
--set tetragon.grpc.address="localhost:54321"
GOOS=$(go env GOOS)
GOARCH=$(go env GOARCH)
curl -L --remote-name-all \
https://github.com/cilium/tetragon/releases/latest/download/tetra-${GOOS}-${GOARCH}.tar.gz
tar -xzvf tetra-${GOOS}-${GOARCH}.tar.gz
sudo install tetra /usr/local/bin/
kubectl get pods -n kube-system -l app.kubernetes.io/name=tetragon
tetra status
创建 TracingPolicy 以检测试图逃逸容器命名空间的进程：
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
name: detect-container-escape
spec:
kprobes:
- call: "__x64_sys_setns"
syscall: true
args:
- index: 0
type: "int"
- index: 1
type: "int"
selectors:
- matchNamespaces:
- namespace: Pid
operator: NotIn
values:
- "host_ns"
matchActions:
- action: Sigkill
检测对敏感凭据的读取：
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
name: monitor-sensitive-files
spec:
kprobes:
- call: "security_file_open"
syscall: false
args:
- index: 0
type: "file"
selectors:
- matchArgs:
- index: 0
operator: "Prefix"
values:
- "/etc/shadow"
- "/etc/kubernetes/pki"
- "/var/run/secrets/kubernetes.io"
matchActions:
- action: Post
阻止已知加密挖矿二进制文件执行：
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
name: block-cryptominers
spec:
kprobes:
- call: "security_bprm_check"
syscall: false
args:
- index: 0
type: "linux_binprm"
selectors:
- matchBinaries:
- operator: "In"
values:
- "/usr/bin/xmrig"
- "/tmp/xmrig"
- "/usr/bin/minerd"
matchActions:
- action: Sigkill
实时流式传输运行时事件：
# 监控所有进程执行事件
kubectl exec -n kube-system ds/tetragon -c tetragon -- \
tetra getevents -o compact --process-only
# 过滤特定命名空间的事件
kubectl exec -n kube-system ds/tetragon -c tetragon -- \
tetra getevents -o compact --namespace production
# 以 JSON 格式导出事件用于 SIEM 集成
kubectl exec -n kube-system ds/tetragon -c tetragon -- \
tetra getevents -o json | tee /var/log/tetragon-events.json
# tetragon-helm-values.yaml
export:
stdout:
enabledCommand: true
enabledArgs: true
filenames:
- /var/log/tetragon/tetragon.log
elasticsearch:
enabled: true
url: "https://elasticsearch.monitoring:9200"
index: "tetragon-events"
Tetragon 在 :2112/metrics 暴露指标：
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: tetragon-metrics
namespace: kube-system
spec:
selector:
matchLabels:
app.kubernetes.io/name: tetragon
endpoints:
- port: metrics
interval: 15s
| 指标 | 描述 | 告警阈值 |
|---|---|---|
tetragon_events_total | 观测到的安全事件总数 | 超过基线 3 倍的峰值 |
tetragon_policy_events_total | 匹配 TracingPolicy 的事件数 | 任何 Sigkill 动作 |
tetragon_process_exec_total | 已追踪的进程执行次数 | 出现异常新二进制文件 |
tetragon_missed_events_total | 因缓冲区溢出丢失的事件数 | 持续 > 0 |