---
name: cilium-tetragon-ebpf
description: "Operate Cilium CNI with Hubble flow observability and author Tetragon eBPF TracingPolicies for runtime security. Run Cilium as a Kubernetes CNI: CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy (L3-L7, DNS-aware, FQDN rules), kube-proxy replacement, Hubble flow observability and hubble-ui/CLI. Author Tetragon TracingPolicies hooking kprobes, tracepoints, and LSM hooks for process_exec/process_exit, socket and network events, and file access, with in-kernel filtering and enforcement via SIGKILL/Override actions. Covers Helm install, identity-based policy, encryption (WireGuard/IPsec), and exporting events to SIEM."
license: MIT
---

# Cilium Tetragon eBPF

Operate Cilium as your Kubernetes CNI and layer Tetragon on top for kernel-level runtime security — all driven through eBPF. This skill helps platform and security engineers write correct `CiliumNetworkPolicy`, `CiliumClusterwideNetworkPolicy`, and Tetragon `TracingPolicy` manifests, debug dropped flows with Hubble, and reason about kube-proxy replacement without guessing at field names.

## When to use it

- You need DNS-aware or FQDN egress rules (e.g., "pods in `payments` may only reach `api.stripe.com`") and want the `toFQDNs` + `toEndpoints` syntax right the first time.
- A connection is being dropped and you need to read `hubble observe --verdict DROPPED` output and map it back to the offending policy.
- You want runtime detection — a process spawned in a container, a write to `/etc/passwd`, or an unexpected outbound socket — expressed as a Tetragon kprobe or LSM hook.
- You're replacing kube-proxy and need to validate `kubeProxyReplacement` mode and socket-LB behavior.

## What it does

Cilium policies are L3–L7 aware. A `CiliumNetworkPolicy` selects pods with `endpointSelector` and gates traffic via `ingress`/`egress` blocks containing `toEndpoints`, `toCIDRSet`, `toFQDNs`, and `toPorts` (with `rules.http` for L7 path/method matching). Cluster-scope rules use `CiliumClusterwideNetworkPolicy` with `nodeSelector` support.

Hubble exposes flow telemetry: `hubble observe`, `hubble status`, and `hubble-ui`. `cilium status`, `cilium connectivity test`, and `cilium policy trace` cover health and policy debugging.

Tetragon `TracingPolicy` objects attach to `kprobes`, `tracepoints`, and BPF LSM hooks. Built-in events include `process_exec` and `process_exit`; you hook syscalls (e.g., `sys_write`, `tcp_connect`) with `selectors` that filter on arguments and can take a `Sigkill` or override action for enforcement. Observe with `tetra getevents -o compact`.

## Usage example

```bash
curl -fsSL --create-dirs -o ~/.claude/skills/cilium-tetragon-ebpf/SKILL.md https://claudeskil.com/skills/cilium-tetragon-ebpf/SKILL.md

# Watch live process executions cluster-wide
tetra getevents -o compact --processes
```

```yaml
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: detect-sensitive-write
spec:
  kprobes:
  - call: "security_file_permission"
    syscall: false
    args:
    - index: 0
      type: "file"
    selectors:
    - matchArgs:
      - index: 0
        operator: "Prefix"
        values: ["/etc/passwd"]
```

## Tips & gotchas

- `toFQDNs` only works if a `toEndpoints` rule also allows the kube-dns pods on port 53 — DNS resolution must be visible to the proxy or names never populate.
- Tetragon `Sigkill` enforcement requires the policy to use `matchActions`; pure observability policies omit it. Test in observe mode first.
- Hubble drops with reason `Policy denied` mean a policy exists and matched; an *absence* of any policy means default-allow — check `cilium endpoint list` for enforcement state.
- LSM-hook policies need a kernel built with BPF LSM enabled and listed in `lsm=`.

## FAQ

**Does Tetragon need Cilium CNI?** No. Tetragon runs standalone on any cluster; Cilium CNI is independent.

**Can policies enforce, not just observe?** Yes — selectors with `Sigkill`/override actions block at the kernel.

**How do I test a policy before applying?** Use `cilium policy trace` and `cilium connectivity test`.