eBPF and Kubernetes - Better Together! Observability and Security with Tetragon | Anna & James

Tetragon is an open source eBPF observability and security tool, hosted by the CNCF as part of the Cilium project. Using eBPF makes it both Kernel and Kubernetes aware, as well as extremely flexible and efficient. Although the collected events are low-level and high-volume in nature, adding Kubernetes context and filtering via Kubernetes CRDs are Tetragon superpowers that make it so powerful. In our talk, we will deep dive into the Tetragon project. We will probe into the technology behind it - eBPF - and understand its potential in observability and security space. Then we will explore a few use cases: process lifecycle, network visibility and file operations. Connecting Kernel and Kubernetes operations - traditionally manual and tedious - will turn out to be straightforward. Finally, we will give the audience pointers to get started and experiment with Tetragon in their clusters.