Cilium Tetragon eBPF

Operate Cilium as your Kubernetes CNI and layer Tetragon on top for kernel-level runtime security — all driven through eBPF. This skill helps platform and security engineers write correct CiliumNetworkPolicy, CiliumClusterwideNetworkPolicy, and Tetragon TracingPolicy manifests, debug dropped flows with Hubble, and reason about kube-proxy replacement without guessing at field names.

When to use it

• You need DNS-aware or FQDN egress rules (e.g., "pods in payments may only reach api.stripe.com") and want the toFQDNs + toEndpoints syntax right the first time.
• A connection is being dropped and you need to read hubble observe --verdict DROPPED output and map it back to the offending policy.
• You want runtime detection — a process spawned in a container, a write to /etc/passwd, or an unexpected outbound socket — expressed as a Tetragon kprobe or LSM hook.
• You're replacing kube-proxy and need to validate kubeProxyReplacement mode and socket-LB behavior.

What it does

Cilium policies are L3–L7 aware. A CiliumNetworkPolicy selects pods with endpointSelector and gates traffic via ingress/egress blocks containing toEndpoints, toCIDRSet, toFQDNs, and toPorts (with rules.http for L7 path/method matching). Cluster-scope rules use CiliumClusterwideNetworkPolicy with nodeSelector support.

Hubble exposes flow telemetry: hubble observe, hubble status, and hubble-ui. cilium status, cilium connectivity test, and cilium policy trace cover health and policy debugging.

Tetragon TracingPolicy objects attach to kprobes, tracepoints, and BPF LSM hooks. Built-in events include process_exec and process_exit; you hook syscalls (e.g., sys_write, tcp_connect) with selectors that filter on arguments and can take a Sigkill or override action for enforcement. Observe with tetra getevents -o compact.

Usage example

curl -fsSL --create-dirs -o ~/.claude/skills/cilium-tetragon-ebpf/SKILL.md https://claudeskil.com/skills/cilium-tetragon-ebpf/SKILL.md

# Watch live process executions cluster-wide
tetra getevents -o compact --processes

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: detect-sensitive-write
spec:
  kprobes:
  - call: "security_file_permission"
    syscall: false
    args:
    - index: 0
      type: "file"
    selectors:
    - matchArgs:
      - index: 0
        operator: "Prefix"
        values: ["/etc/passwd"]

Tips & gotchas

• toFQDNs only works if a toEndpoints rule also allows the kube-dns pods on port 53 — DNS resolution must be visible to the proxy or names never populate.
• Tetragon Sigkill enforcement requires the policy to use matchActions; pure observability policies omit it. Test in observe mode first.
• Hubble drops with reason Policy denied mean a policy exists and matched; an absence of any policy means default-allow — check cilium endpoint list for enforcement state.
• LSM-hook policies need a kernel built with BPF LSM enabled and listed in lsm=.

FAQ

Does Tetragon need Cilium CNI? No. Tetragon runs standalone on any cluster; Cilium CNI is independent.

Can policies enforce, not just observe? Yes — selectors with Sigkill/override actions block at the kernel.

How do I test a policy before applying? Use cilium policy trace and cilium connectivity test.