Tetragon：一款基于eBPF的运行时环境安全监控工具

export NAME="$(whoami)-$RANDOM"export ZONE="us-west2-a"gcloud container clusters create "${NAME}" --zone ${ZONE} --num-nodes=1gcloud container clusters get-credentials "${NAME}" --zone ${ZONE}

export NAME="$(whoami)-$RANDOM"export AZURE_RESOURCE_GROUP="${NAME}-group"az group create --name "${AZURE_RESOURCE_GROUP}" -l westus2az aks create --resource-group "${AZURE_RESOURCE_GROUP}" --name "${NAME}"az aks get-credentials --resource-group "${AZURE_RESOURCE_GROUP}" --name "${NAME}"

helm repo add cilium https://helm.cilium.iohelm repo updatehelm install tetragon ${EXTRA_HELM_FLAGS[@]} cilium/tetragon -n kube-systemkubectl rollout status -n kube-system ds/tetragon -w

docker run -d --name tetragon --rm --pull always     --pid=host --cgroupns=host --privileged                 -v /sys/kernel/btf/vmlinux:/var/lib/tetragon/btf        quay.io/cilium/tetragon:v1.3.0

kubectl edit cm -n kube-system tetragon-config# Change your configuration setting, save and exit# Restart Tetragon daemonsetkubectl rollout restart -n kube-system ds/tetragon

# Change configuration inside /etc/tetragon/ then restart container.# Example:#   1. As a privileged user, write to the file /etc/tetragon/tetragon.conf.d/export-file#      the path where to export events, example "/var/log/tetragon/tetragon.log"#   2. Bind mount host /etc/tetragon into container /etc/tetragon# Tetragon events will be exported to /var/log/tetragon/tetragon.logecho "/var/log/tetragon/tetragon.log" > /etc/tetragon/tetragon.conf.d/export-filedocker run --name tetragon --rm -d   --pid=host --cgroupns=host --privileged   -v /etc/tetragon:/etc/tetragon   -v /sys/kernel:/sys/kernel   -v /var/log/tetragon:/var/log/tetragon   quay.io/cilium/tetragon:v1.3.0   /usr/bin/tetragon

kubectl exec -ti -n kube-system ds/tetragon -c tetragon -- tetra getevents -o compact --pods xwing

POD=$(kubectl -n kube-system get pods -l 'app.kubernetes.io/name=tetragon' -o name --field-selector spec.nodeName=$(kubectl get pod xwing -o jsonpath='{.spec.nodeName}'))kubectl exec -ti -n kube-system $POD -c tetragon -- tetra getevents -o compact --pods xwing

docker exec tetragon tetra getevents -o compact

{  "process_exec": {    "process": {      "exec_id": "Z2tlLWpvaG4tNjMyLWRlZmF1bHQtcG9vbC03MDQxY2FjMC05czk1OjEzNTQ4Njc0MzIxMzczOjUyNjk5",      "pid": 52699,      "uid": 0,      "cwd": "/",      "binary": "/usr/bin/curl",      "arguments": "https://ebpf.io/applications/#tetragon",      "flags": "execve rootcwd",      "start_time": "2023-10-06T22:03:57.700327580Z",      "auid": 4294967295,      "pod": {        "namespace": "default",        "name": "xwing",        "container": {          "id": "containerd://551e161c47d8ff0eb665438a7bcd5b4e3ef5a297282b40a92b7c77d6bd168eb3",          "name": "spaceship",          "image": {            "id": "docker.io/tgraf/netperf@sha256:8e86f744bfea165fd4ce68caa05abc96500f40130b857773186401926af7e9e6",            "name": "docker.io/tgraf/netperf:latest"          },          "start_time": "2023-10-06T21:52:41Z",          "pid": 49        },        "pod_labels": {          "app.kubernetes.io/name": "xwing",          "class": "xwing",          "org": "alliance"        },        "workload": "xwing"      },      "docker": "551e161c47d8ff0eb665438a7bcd5b4",      "parent_exec_id": "Z2tlLWpvaG4tNjMyLWRlZmF1bHQtcG9vbC03MDQxY2FjMC05czk1OjEzNTQ4NjcwODgzMjk5OjUyNjk5",      "tid": 52699    },    "parent": {      "exec_id": "Z2tlLWpvaG4tNjMyLWRlZmF1bHQtcG9vbC03MDQxY2FjMC05czk1OjEzNTQ4NjcwODgzMjk5OjUyNjk5",      "pid": 52699,      "uid": 0,      "cwd": "/",      "binary": "/bin/bash",      "arguments": "-c "curl https://ebpf.io/applications/#tetragon"",      "flags": "execve rootcwd clone",      "start_time": "2023-10-06T22:03:57.696889812Z",      "auid": 4294967295,      "pod": {        "namespace": "default",        "name": "xwing",        "container": {          "id": "containerd://551e161c47d8ff0eb665438a7bcd5b4e3ef5a297282b40a92b7c77d6bd168eb3",          "name": "spaceship",          "image": {            "id": "docker.io/tgraf/netperf@sha256:8e86f744bfea165fd4ce68caa05abc96500f40130b857773186401926af7e9e6",            "name": "docker.io/tgraf/netperf:latest"          },          "start_time": "2023-10-06T21:52:41Z",          "pid": 49        },        "pod_labels": {          "app.kubernetes.io/name": "xwing",          "class": "xwing",          "org": "alliance"        },        "workload": "xwing"      },      "docker": "551e161c47d8ff0eb665438a7bcd5b4",      "parent_exec_id": "Z2tlLWpvaG4tNjMyLWRlZmF1bHQtcG9vbC03MDQxY2FjMC05czk1OjEzNTQ4NjQ1MjQ1ODM5OjUyNjg5",      "tid": 52699    }  },  "node_name": "gke-john-632-default-pool-7041cac0-9s95",  "time": "2023-10-06T22:03:57.700326678Z"}