Configure a Cilium Tetragon TracingPolicy to observe file opens on sensitive directories using a tracepoint

Steps

1. Write a TracingPolicy using the 'tracepoints' array instead of 'kprobes', specifying the tracepoint subsystem and event such as 'syscalls/sys_enter_openat'
2. Define argument capture for the relevant tracepoint fields including the filename argument using the correct index for the openat syscall tracepoint
3. Add a 'selectors' block with 'matchArgs' to filter events where the filename argument starts with or equals a sensitive directory path
4. Apply the policy and confirm it is accepted; check Tetragon pod logs for any policy loading errors
5. Use 'tetra getevents --namespace your-namespace' to stream events and verify file open events from the target path are captured
6. Optionally add a matchNamespaces or matchCapabilities selector to scope monitoring to privileged workloads only