🐝Cilium Talks from KubeCon NA 2024🐝
@mtardy_, @joestringernz, Kornilios Kourtis, and @jrfastab from @isovalent will hold a Contribfest session titled "Kickstart Your eBPF Journey With Tetragon"
Join in!
For more information 👇
sched.co/1hoyj
Join us for the Tetragon First Community Call 🎉
📅Date: Monday 11th March
⏲️ Time: 5:00 PM UTC
🗒️ Meeting Notes and Link: isogo.to/tetragon-meeting-no…
🧵What to expect from the call? 👇
1/2
Tetragon 1.0 has landed! 🎉 It features new default observability policies, extensive overhead benchmarks, and a ton of maturization, along with many additional features. Let's take a closer look 🧵
isovalent.com/blog/post/tetr…
Tetragon is the newest member of the Cilium hive, helping keep it secure🔒
Join @mtardy_ for a Tetragon introduction and demo.
Date: Wednesday, 19 July 2023
Time: 5:00pm CEST - 8:00am PT.
Venue: @kubernetesio SIG security tooling meeting
1/2
Thanks so much for coming to see Nurturing Security Permaculture at #KubeCon2023 with @asolsvig @coffeeartgirl @mtardy_
The slides are up-to-date on Sched, if you want to check them out or click the links :-)
kccnceu2023.sched.com/event/…
Microsoft OMI is an open source systems management framework for Linux and UNIX used on-premise and Azure. In this blog post @blindevy and @mtardy_ give a brief introduction to it and tell us how they found some bugs while fuzzing the project. #omi#Azureblog.quarkslab.com/a-gentle-…
ALT "Many Linux servers controlled by a monkey" by Stable Diffusion, 2023
Falco completed a security audit, sponsored by CNCF & supported by Open Source Technology Improvement Fund. Quarkslab SAS found minor vulnerabilities & provided recommendations for analysis strategies. Read more about it here: falco.org/blog/falco-securit…
ALT Tracing Policy
TracingPolicy is a user-configurable Kubernetes custom resource (CR) that allows users to trace arbitrary events in the kernel and optionally define actions to take on a match, for enforcement for example. Currently, two types of events are supported: kprobes and tracepoints, but others may be added in the future (e.g., uprobes) by following a similar approach.
Note that TracingPolicy can be considered low-level since they require knowledge about the Linux kernel and containers to be written correctly. In the future, we are considering to add a high-level RuntimeSecurityPolicy which would take this complexity away.
For the complete custom resource definition (CRD) refer to the YAML file cilium.io_tracingpolicies.yaml. One practical way to explore the CRD is to use kubectl explain against a Kubernetes API server on which it is installed, for example kubectl explain tracingpolicy.spec.kprobes provides field-specific documentation and details on kprobe spec.
For bare met
My talk with John on Securing the Superpowers: Who loaded that eBPF program is now on Youtube.
If you are interested in how we keep track and audit BPF program and map loading at @isovalent, check it out.
youtu.be/UBVTJ0LeXxc
Experience the power of #community at the Kubernetes Community Days in Zurich! When a diverse group of experts come together to learn, #network, and share knowledge on all things #cloudnative.
Learn more - get your ticket now: kcdzurich.ch/
99% of /proc/pid/stat parsing code is buggy.
It splits by space, but 2nd field is exe name which may contain space:
Bugs are everywhere: OpenJDK, qemu, BoehmGC, containers/sandboxes; same bug in C/C /Java/Go/Py/JS/Rust, ~every hit:
sourcegraph.com/search?q=con…
Fix: strrchr(')') first