Skip to content

Back to the catalog

Kubernetes Runtime Security : The Guide
cilium.ioarticle

Kubernetes Runtime Security : The Guide

A guide to Kubernetes runtime security using Cilium Tetragon, an eBPF-based observability and enforcement tool. It covers the runtime threat model (container escape, lateral movement, cryptomining, exfiltration, supply chain), how kprobes, tracepoints, uprobes and LSM hooks provide kernel visibility, and detections for reverse shells, fileless execution (memfd_create), SUID abuse and DNS exfiltration. It also explains TracingPolicy selectors and actions (Post, Sigkill, Override), a detect-then-enforce rollout, and mapping to PCI-DSS, SOC 2, NIST SP 800-190 and the CIS Kubernetes Benchmark.

TL;DR Cilium's guide to Kubernetes runtime security with Tetragon and eBPF: threat model, kernel hooks, TracingPolicy, key detections and compliance mapping.
Open original ↗

Organisations named here

  • fileless execution
  • memfd_create
  • PCI DSS
  • SUID

Technologies named here

  • Kubernetes clusters and worker nodes
  • Cilium
  • Linux containers
  • Linux Security Module hooks
  • SIEM integration
  • Kubernetes RBAC
  • Image scanners
  • Compliance frameworks referenced
  • Kubernetes
  • Tetragon
  • eBPF
  • Linux kernel
  • NIST SP 800-190
  • CIS Kubernetes Benchmark
  • SOC 2

Techniques named here

  • Container escape and privilege escalation
  • Lateral movement
  • Cryptomining and resource abuse
  • Data exfiltration
  • Supply-chain attacks
  • Reverse shells
  • Fileless execution using memfd_create
  • SUID binary abuse for privilege escalation
  • Command and control connections and malware download
  • Kubernetes runtime security
  • Container escape
  • Reverse shell
  • DNS tunneling

Related in Cloud & Infra