tetragon snippets

this is process logs that will collected by ebpf system


{
  "process_exec": {
    "process": {
      "exec_id": "aXAtMTkyLTE2OC0yNi00Mi5lYzIuaW50ZXJuYWw6MTE0MDc1MTE4MzczNTo5NTYy",
      "pid": 9562,
      "uid": 0,
      "cwd": "/",
      "binary": "/usr/bin/sleep",
      "arguments": "infinity",
      "flags": "execve rootcwd clone inInitTree",
      "start_time": "2025-09-06T14:15:23.429928979Z",
      "auid": 4294967295,
      "pod": {
        "namespace": "default",
        "name": "sleepy",
        "container": {
          "id": "containerd://0220ba0f817a9075e33063e5f088dac22eaa11b46842b42e1f0f70044f615f15",
          "name": "sleepy",
          "image": {
            "id": "docker.io/library/ubuntu@sha256:9cbed754112939e914291337b5e554b07ad7c392491dba6daf25eef1332a22e8",
            "name": "docker.io/library/ubuntu:latest"
          },
          "start_time": "2025-09-06T14:15:23Z",
          "pid": 1,
          "security_context": {}
        },
        "pod_labels": {
          "run": "sleepy"
        },
        "workload": "sleepy",
        "workload_kind": "Pod"
      },
      "docker": "0220ba0f817a9075e33063e5f088dac",
      "parent_exec_id": "aXAtMTkyLTE2OC0yNi00Mi5lYzIuaW50ZXJuYWw6MTEzODgzMzE2OTQ1Mjo5NDk4",
      "tid": 9562,
      "in_init_tree": true
    },
    "parent": {
      "exec_id": "aXAtMTkyLTE2OC0yNi00Mi5lYzIuaW50ZXJuYWw6MTEzODgzMzE2OTQ1Mjo5NDk4",
      "pid": 9498,
      "uid": 0,
      "cwd": "/run/containerd/io.containerd.runtime.v2.task/k8s.io/acbdc0ff29ff8d29aff06385a8e9b5bd4ca80fc626e3a683d743d2923db225d6",
      "binary": "/usr/bin/containerd-shim-runc-v2",
      "arguments": "-namespace k8s.io -id acbdc0ff29ff8d29aff06385a8e9b5bd4ca80fc626e3a683d743d2923db225d6 -address /run/containerd/containerd.sock",
      "flags": "execve clone",
      "start_time": "2025-09-06T14:15:21.511914007Z",
      "auid": 4294967295,
      "parent_exec_id": "aXAtMTkyLTE2OC0yNi00Mi5lYzIuaW50ZXJuYWw6MTEzODgyMzEwNDUyMzo5NDg5",
      "tid": 9498,
      "in_init_tree": false
    }
  },
  "node_name": "ip-192-168-26-42.ec2.internal",
  "time": "2025-09-06T14:15:23.429928417Z",
  "node_labels": {
    "alpha.eksctl.io/cluster-name": "myeks-8",
    "alpha.eksctl.io/nodegroup-name": "ng-fb6baf33",
    "beta.kubernetes.io/arch": "amd64",
    "beta.kubernetes.io/instance-type": "t3.medium",
    "beta.kubernetes.io/os": "linux",
    "eks.amazonaws.com/capacityType": "ON_DEMAND",
    "eks.amazonaws.com/nodegroup": "ng-fb6baf33",
    "eks.amazonaws.com/nodegroup-image": "ami-0329ac7d12d171324",
    "eks.amazonaws.com/sourceLaunchTemplateId": "lt-0d5f20521207a4f85",
    "eks.amazonaws.com/sourceLaunchTemplateVersion": "1",
    "failure-domain.beta.kubernetes.io/region": "us-east-1",
    "failure-domain.beta.kubernetes.io/zone": "us-east-1a",
    "k8s.io/cloud-provider-aws": "a45db77541dc5d0a0f1385074b60166a",
    "kubernetes.io/arch": "amd64",
    "kubernetes.io/hostname": "ip-192-168-26-42.ec2.internal",
    "kubernetes.io/os": "linux",
    "node.kubernetes.io/instance-type": "t3.medium",
    "topology.ebs.csi.aws.com/zone": "us-east-1a",
    "topology.k8s.aws/zone-id": "use1-az1",
    "topology.kubernetes.io/region": "us-east-1",
    "topology.kubernetes.io/zone": "us-east-1a"
  }
}

Here are the most important fields to keep when designing policies around enforcement:

---

🔹 Process & Execution Context

• process.binary → the actual executable (/usr/bin/sleep, /bin/bash, etc.)

• process.arguments → arguments passed to the binary (e.g., sleep infinity)

• process.uid → which user ran the process (0 = root)

• process.cwd → working directory (sometimes important for distinguishing behavior)

• process.flags → useful for detecting execve, setuid, init process, etc.

---

🔹 Container / Pod Context

• process.pod.namespace → Kubernetes namespace

• process.pod.name → Pod name

• process.pod.container.name → Container name

• process.pod.container.image.name → Image name (docker.io/library/ubuntu:latest)

• process.pod.pod_labels → Kubernetes labels (for selecting workloads via policies)

• process.pod.workload_kind → Pod, Deployment, DaemonSet, etc.

---

🔹 Parent Process Context

• parent.binary → helps detect container runtimes or unexpected parent processes

• parent.exec_id → trace lineage of execution

---

🔹 Node / Cluster Context

• node_name → node where the event occurred

• node_labels → useful for scoping policies to node groups, zones, instance types, etc.

---

🔹 Event Metadata

• time → event timestamp (critical for audit trails)

• process.exec_id → unique identifier for correlation

• parent_exec_id → trace back execution chains

---

✅ In practice, the core fields most often used for enforcement are:

• Binary / arguments

• Pod namespace / name / labels

• Container image

• User (UID)

• Parent binary

• Node name (if node-specific policies are needed)

install tetragon CLI and move its binary to /usr/loval/bin/

# Download the latest tetra (Linux x86_64 example)
curl -L https://github.com/cilium/tetragon/releases/latest/download/tetra-linux-amd64.tar.gz -o tetra.tar.gz

# Extract and move to /usr/local/bin
tar -xvf tetra.tar.gz
sudo mv tetra /usr/local/bin/

# Verify
tetra version

now check logs

kubectl logs -f -n kube-system ds/tetragon -c export-stdout | tetra getevents -o compact