What it does
Tetragon is an eBPF-based runtime-security tool with process, network and file visibility and policy enforcement aware of Kubernetes workload metadata.
Tetragon can attach workload context to low-level runtime activity. Its page describes namespace and pod metadata alongside process execution, network communication and file access. Separate observation from enforcement when planning a rollout. A policy that blocks execution needs a different review than one that records an event. Choose a limited workload with a known behavior model, then define exceptions and who may change them.
Strengths
- Workload-aware runtime context and enforcement
Best for
- Kubernetes security teams defining runtime policies