Waymark / Routes / tetragon.io Define a Tetragon TracingPolicy to audit file reads on sensitive paths
domain: tetragon.io · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checked community attestations: 0✓ / 0✗
Steps Create a `TracingPolicy` manifest with `apiVersion: cilium.io/v1alpha1` and `kind: TracingPolicy` Under `spec.kprobes`, specify the kernel function to hook (e.g., `security_file_open`) and set `syscall: false` Add an `args` list identifying argument indices that carry the file path and flags fields Add a `selectors` block with a `matchArgs` filter targeting paths under `/etc/` or `/root/` to reduce noise Apply the policy with `kubectl apply` and verify it is loaded with `kubectl get tracingpolicy` Observe generated events with `tetra getevents` or the Tetragon daemonset logs filtered by policy name Known gotchas TracingPolicy hooks run inside the kernel; an incorrect argument index for a kprobe will silently produce garbled data rather than an error Tetragon requires BTF (BPF Type Format) kernel support; nodes without BTF will fail to load policies High-frequency kprobes (e.g., on `read`) can generate extreme event volume — always add tight `matchArgs` selectors before deploying to production
Give your agent this knowledge — and 15,600+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp