Djalal Harouni

Users and even developers may get confused on why Tetragon is not working or did it find the appropriate BTF files. Improve logging and reduce confusion Signed-off-by: Djalal Harouni

Tetragon: rework cgroups handling

2

This improves Tetragon cgroups and process tracking. Every process will have its own tracking Cgroup ID that should reflect the proper container. ### TODO - [x] Handle cgroup tracepoint: mkdir,...

Tetragon main program should unmount filesystems and probably remove related dirs inside /run/tetragon. This should run only if a real syscall.mount() was performed by Tetragon itself, must not collide with...

tetragon: GetPodInfo() is called even a non k8s deployments

3

GetPodInfo() where we get the pod info for the events is being called even if Tetragon is run with `enable-k8s-api:false` , this is not an urgent or real issue unless...

Add support for loading raw_tracepoint programs which are better compared to classic ones as they allow to access raw data structs. We will need them in following patches to improve...

For now we just put the raw syscalls inside files, in future we may have declarative groups to make it easy for users.

tetragon: print current main tetragon security context from /proc/self/attr

11

Early at startup read current security context and print it, this will help debug cryptic errors cases if SELinux, Apparmor are applied to tetragon, even if we are under a...

Log CRD actions being executed to Trace level, so at least they are visible into main Tetragon without extra steps. Example: sigkill should be logged.