tetragon

No entries match these filters. Clear filters

1. v1.8.0 Oct 30, 2026 · issue 126

   Tetragon v1.8.0 adds stateful tracing policies, command-line argument selectors, mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. for the gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. server, and uprobeuprobeA Linux kernel dynamic tracing mechanism that lets you attach instrumentation to any userspace function at runtime, without recompiling the target binary, giving cyber tools deep visibility into application behavior. binary digest verification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.8.0 https://github.com/cilium/tetragon.git
   # already have the repo? check out this version:
   $ git checkout v1.8.0

   └──▷ TRY IT
   Prevent execve map from pre-allocating memory at startup to reduce idle memory usage on nodes with many short-lived processes.
   copy

   $ tetragon --execve-map-no-prealloc

   • Add new tracing policy selectors: matchCmdArgs to filter tracing events by individual command-line arguments of the invoking process, matchWorkloads, nodeSelector, and MatchCEL to allow mixing arguments and data in CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. expressions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Add caller function filtering to uprobe selectors in tracing policies.
   • Add support for stateful tracing policies, gRPC-based persistent policies, JSON schema and CEL validation for tracing policies without Kubernetes support, an eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic.-based glob library for tracing policy matching, and domain-sharded tracing policy management.
   • Replace the deprecated sizeArgIndex field with sizeFromArgIndex in tracing policies.
   • Add the uprobe Set action with u64 argValue support, and symbolized user-space stack traces to ProcessUprobe events for uprobe Post actions that enable userStackTrace.

   +5 more show less

   • (improved) Add argNew{Symbol,Addr,Offset} support to the uprobe override action and support for multiple sopath actions in uprobes.
   • (improved) Add support for CEL expressions in argRegs register overrides, bit-shifting operators (lsh, rsh), 16-bit and 8-bit signed and unsigned integers, and multiplication and division operators to CEL expressions.
   • Add bitwise operators (and, or, xor, not) for CEL expressions.
   • Add btfType and btfTypeModule argument types, support for the fd type to retrieve file*, the --sleepable-preload-size option to configure the sleepable preload size, a read-only, frozen configuration map, the --execve-map-no-prealloc option to control execve map memory allocation, and BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. area-specific DEBUG() rodata configuration for BPF sensors.
   • Add support for multiple preloaded string-resolved arguments in BPF sensors.
   • Add new tracing policy selectors: matchCmdArgs to filter tracing events by individual command-line arguments of the invoking process, matchWorkloads, nodeSelector, and MatchCEL to allow mixing arguments and data in CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. expressions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Add support for stateful tracing policies, gRPC-based persistent policies, JSON schema and CEL validation for tracing policies without Kubernetes support, an eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic.-based glob library for tracing policy matching, and domain-sharded tracing policy management.
   • Add the uprobe Set action with u64 argValue support, and symbolized user-space stack traces to ProcessUprobe events for uprobe Post actions that enable userStackTrace.
   • Add bitwise operators (and, or, xor, not) for CEL expressions.
   • Add btfType and btfTypeModule argument types, support for the fd type to retrieve file*, the --sleepable-preload-size option to configure the sleepable preload size, a read-only, frozen configuration map, the --execve-map-no-prealloc option to control execve map memory allocation, and BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. area-specific DEBUG() rodata configuration for BPF sensors.

   5 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The deprecated sizeArgIndex field is replaced by sizeFromArgIndex; policies using sizeArgIndex must be updated.
   • !Deprecated actions have been removed; policies referencing them will be rejected on upgrade.
   • !matchArgs/matchBinaries Postfix and NotPostfix values longer than 87 characters are now rejected on kernels without large BPF program support.
   • !The gops debug interface is now disabled by default in the Helm chart.
   • !Metrics labels are changed: opcode now carries the numeric ops.OpCode, opstr is the new label for its readable name, and event_type replaces prior EventType labeling; dashboards or alerts keyed on the old label names will break.
2. docs update Oct 4, 2026 · issue 094

   Tetragon tracing-policy CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. selectors gain multiplication (*) and division operators for numeric expressions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3. docs update Oct 4, 2026 · issue 094

   Tetragon adds uprobe-heap-size tracing policy option for per-policy uprobeuprobeA Linux kernel dynamic tracing mechanism that lets you attach instrumentation to any userspace function at runtime, without recompiling the target binary, giving cyber tools deep visibility into application behavior./USDTUSDTUserspace Statically Defined Tracing probes, a mechanism originating in Solaris and adopted by Linux, that lets a program embed named hook points so debuggers and tracers can attach at runtime with near-zero overhead when idle. heap map sizing⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Isolate a high-volume uprobe policy with its own heap maps so it does not starve other policies sharing the global pool.
   yaml copy

   options:
     uprobe-heap-size: "65536"

4. docs update Sep 25, 2026 · issue 085

   Tetragon adds matchUserCallers selector to filter tracing policy events by user-space callstack depth and symbol⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Trigger a uprobe only when func2 is called from main at exactly depth 2 in the user-space callstack.
   yaml copy

   matchUserCallers:
     - depth: 2
       symbol: "main"

   Match a caller by address range in a different shared library when the symbol name is unavailable.
   yaml copy

   matchUserCallers:
     - depth: 1
       binary: "/lib64/libcustom.so.1"
       startRange: 0x1234
       endRange: 0x1280

   Search for a caller anywhere in the first 15 frames when exact call depth is unknown.
   yaml copy

   matchUserCallers:
     - depth: "any"
       symbol: "main"

   • Adds matchUserCallers selector to TracingPolicy to filter uprobe events based on the user-space callstack of the hooked function, supporting up to 5 entries per selector with depth values 1–15 or 'any'.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports matching callers by symbol name or by startRange/endRange byte offsets relative to the executable or shared object (mutually exclusive with symbol).
   • Supports a binary field within matchUserCallers entries to specify the binary path when the caller function lives in a different binary or shared library than the hooked function.
   • Setting depth to 'any' searches the first 15 frames of the callstack, enabling matching when exact call depth is unknown.

   4 details in Everything

5. docs update Sep 22, 2026 · issue 082

   Tetragon adds matchUserCallers selector to filter tracing policy events by user-space callstack depth and symbol.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Trigger a uprobe policy only when func2 is called from main at callstack depth 2, filtering out unrelated callers.
   yaml copy

   matchUserCallers:
     - depth: 2
       symbol: "main"

   Search the first 15 callstack frames for a caller by address range when the exact depth is unknown or when the caller is in a different binary.
   yaml copy

   matchUserCallers:
     - depth: "any"
       startRange: 0x1234
       endRange: 0x1280

   • Adds matchUserCallers selector to TracingPolicy, enabling filtering based on the user-space callstack of a hooked uprobe function by depth (1–15 or "any"), symbol, startRange/endRange offsets, and an optional binary path field for cross-binary callers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports up to 5 entries in a single matchUserCallers selector, all of which must match for the selector to trigger.
   • matchUserCallers selector is limited to uprobe hooks only, requires frame pointers in all binaries and linked libraries, and needs kernel ≥6.12 on amd64 to match the immediate caller (depth 1); arm64 does not support depth 1 matching.

   3 details in Everything

6. docs update Sep 9, 2026 · issue 069

   Tetragon adds fentry/fexitfentry/fexitLinux kernel BPF hook points that attach to the entry and return of kernel functions with near-zero overhead, letting cyber tools trace or intercept kernel behavior without modifying kernel source. hook support as a faster BTFBTFBPF Type Format, a metadata format in the Linux kernel that embeds type and debug information directly into eBPF programs, letting cyber tools inspect kernel structures safely without kernel headers at runtime.-based alternative to kprobeskprobesA Linux kernel debugging mechanism that lets a program dynamically insert breakpoints into almost any kernel instruction, triggering a callback without recompiling or rebooting — giving cyber tools deep runtime kernel visibility. for tracing kernel functions

   └──▷ USE IT
   Trace TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connection establishment at kernel entry using fentry — lower overhead than an equivalent kprobe policy.
   yaml copy

   fentries:
     - call: "tcp_connect"
       args:
         - index: 0
           type: "sock"

   Capture the return value of a kernel function by enabling fexit alongside fentry in the same spec.
   yaml copy

   fentries:
     - call: "tcp_connect"
       return: true
       args:
         - index: 0
           type: "sock"

   Trace multiple kernel functions in one policy to monitor both TCP connect and close events.
   yaml copy

   fentries:
     - call: "tcp_connect"
       args:
         - index: 0
           type: "sock"
     - call: "tcp_close"
       args:
         - index: 0
           type: "sock"

   • Adds fentries section to TracingPolicy specs, enabling fentry/fexit BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. programs that attach to kernel functions via BTF and the ftrace trampoline — faster than kprobes and available on kernels >= 6.1 with CONFIG_DEBUG_INFO_BTF=y.
   • Supports tracing system calls via fentry by setting the syscall ABI field, applying the same symbol naming rules as kprobes.
   • Supports multiple fentry specs in a single policy by listing multiple entries under the fentries section (e.g. tcp_connect and tcp_close).
   • Attaches fexit programs (capturing return values) by setting return: true in the fentry spec.
   • Fentry specs support the same argument filtering and in-kernel selector fields as kprobes, but enforcement actions such as Override and Signal are not supported, and there is no multi-attach equivalent to multi kprobes.
   • Adds fentries section to TracingPolicy specs, enabling fentry/fexit BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. programs that attach to kernel functions via BTF and the ftrace trampoline — faster than kprobes and available on kernels >= 6.1 with CONFIG_DEBUG_INFO_BTF=y.
   • Supports multiple fentry specs in a single policy by listing multiple entries under the fentries section (e.g. tcp_connect and tcp_close).
   • Attaches fexit programs (capturing return values) by setting return: true in the fentry spec.
   • Fentry specs support the same argument filtering and in-kernel selector fields as kprobes, but enforcement actions such as Override and Signal are not supported, and there is no multi-attach equivalent to multi kprobes.

   1 more in Everything

7. docs update Sep 9, 2026 · issue 069

   Tetragon tracing-policy selector expressions gain lsh() and rsh() bit-shift operators for CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. filter logic.

   • Adds lsh() (left shift) and rsh() (right shift) bit-shifting functions to CEL expressions in tracing-policy selectors.

   1 more in Everything

8. docs update Sep 9, 2026 · issue 069

   Tetragon adds redact_str field and namespace_regex filter to event redaction configuration

   • Adds redact_str field to redaction rules, letting operators specify a custom replacement string (e.g. <redacted:password>) instead of the default redaction placeholder, making individual redaction rules identifiable in alerts.
   • Adds namespace_regex filter to scope event filtering by Kubernetes pod namespace using a list of regular expressions.
   • Adds namespace_regex filter to scope event filtering by Kubernetes pod namespace using a list of regular expressions.

   1 more in Everything

9. docs update Sep 1, 2026 · issue 061

   Tetragon adds matchCmdArgs selector to filter on process command-line arguments in tracing policies.

   • Adds matchCmdArgs selector to tracing policies, filtering on arguments passed to the current process at execution time (distinct from matchArgs, which filters arguments passed to the hook); indexes are zero-based, exclude argv[0], and support up to five matchCmdArgs filters per selector with argument indexes ranging from 0 to 31.
   • Tetragon caches at most the first 256 bytes of command-line arguments (including NUL separators); arguments beyond that limit are truncated and cannot match.
   • matchCmdArgs requires large BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. program support, available on Linux kernel 5.3 and later.
   • Adds Set action for USDTUSDTUserspace Statically Defined Tracing probes, a mechanism originating in Solaris and adopted by Linux, that lets a program embed named hook points so debuggers and tracers can attach at runtime with near-zero overhead when idle. and uprobe probes, allowing the value of a function argument to be overwritten at the given index; for uprobes the argument must be an integer parameter (uint32) at index 0–5 on amd64 or 0–7 on arm64.

   4 details in Everything

10. docs update Aug 25, 2026 · issue 056

    Tetragon adds matchCEL selector for CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine.-expression-based event filtering in tracing policies

    └──▷ USE IT
    Filter a tracing policy to trigger only when lseek is called with specific argument relationships, using a CEL expression instead of the deprecated MatchArgs operator.
    yaml copy

    matchCEL:
      expr: "arg1 == int32(-1) && data0 == arg0 + int32(42)"

    └──▷ BREAKING ON UPGRADE

    • !The MatchArgs operator is deprecated in favour of the MatchCEL selector.
11. v1.7.1 Aug 25, 2026 · issue 056

    Tetragon v1.7.1 adds int tracepoint args, btfType/btfTypeModule support, and broader policy-filter scoping for uprobes and USDTUSDTUserspace Statically Defined Tracing probes, a mechanism originating in Solaris and adopted by Linux, that lets a program embed named hook points so debuggers and tracers can attach at runtime with near-zero overhead when idle. events.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.1 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.7.1

    • Adds btfType and btfTypeModule support in tracing policies, enabling more precise BTFBTFBPF Type Format, a metadata format in the Linux kernel that embeds type and debug information directly into eBPF programs, letting cyber tools inspect kernel structures safely without kernel headers at runtime.-based type resolution for kernel arguments.
    • Adds int argument type support for tracepoints in TracingPolicy, expanding the set of kernel tracepoint arguments that can be traced and filtered.
    • Allows hostSelector in TracingPolicy without requiring the enable-policy-filter daemon flag, reducing configuration overhead for host-scoped policies.
    • Scopes uprobe and USDT events through policy filters, bringing them in line with kprobe/tracepoint filtering capabilities.
    • Applies redaction filters to all environment variables in events, broadening the reach of existing redaction configuration.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !returnArgAction no longer accepts Post as a value in TracingPolicy. Use returnArg to include return values in events and omit returnArgAction for default behavior; only TrackSock and UntrackSock remain supported. Existing policies with returnArgAction: "Post" must remove that field.
12. docs update Aug 24, 2026 · issue 055

    Tetragon TracingPolicy CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. expressions gain bitwise operators: and(), or(), xor(), not()

    • Adds bitwise operators and(), or(), xor(), and not() to CelExpr selectors in TracingPolicy, enabling fine-grained flag and bitmask matching in kernel event filters.

    1 detail in Everything

13. docs update Aug 1, 2026 · issue 032

    Tetragon adds partial policy loading via ignore.digestVerificationFailure for uprobe binary digest mismatches

    • New ignore.digestVerificationFailure field in tracing policies lets hooks that fail SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. binary digest verification be skipped instead of rejecting the entire policy.
    • Partially loaded policies are surfaced via TracingPolicyStatus per-hook status and a new TP_STATE_PARTIALLY_ENABLED state in TracingPolicyState, so operators can see exactly which uprobes were attached.

    2 details in Everything

14. advisory CVE-2026-65960 Jul 27, 2026 · issue 128
    • CVE-2026-65960: Unauthenticated Tetragon gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. admin API accessible from hostNetwork pods (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects < v1.7.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
15. docs update Jul 24, 2026 · issue 024

    Tetragon gains persistent gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. policies: tracing policies survive agent restarts with zero enforcement gaps via BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. handoff.

    └──▷ TRY IT
    Start Tetragon with persistent gRPC policies and zero-gap enforcement so tracing policies survive agent restarts without dropping coverage.
    copy

    $ sudo ./tetragon \
      --btf /sys/kernel/btf/vmlinux \
      --bpf-lib ./bpf/objs/ \
      --keep-sensors-on-exit \
      --release-pinned-bpf=false \
      --persist-grpc-policies \
      --persist-grpc-policies-dir /var/run/tetragon/grpc-policies

    Add a tracing policy via gRPC so it is automatically persisted to the store and survives the next agent restart.
    copy

    $ sudo ./tetra tracingpolicy add policy.yaml

    Switch a persisted policy to monitor-only mode; the store is updated so the mode is preserved after restart.
    copy

    $ sudo ./tetra tracingpolicy set-mode lsm-file-open monitor

    • New --persist-grpc-policies flag enables saving and restoring tracing policies installed via gRPC across agent restarts.
    • New --persist-grpc-policies-dir flag selects the directory used as the policy store (default: /var/run/tetragon/grpc-policies).
    • Combined with --keep-sensors-on-exit and --release-pinned-bpf=false, Tetragon performs a zero-gap BPF handoff: the old BPF tree stays attached until replacement programs are fully loaded.
    • Policy lifecycle operations (tetra tracingpolicy add/delete/enable/disable/set-mode) automatically sync the persistent store, including desired enabled state and policy mode.
    • Atomic failure handling ensures the running policy and its stored record stay consistent — failed store writes roll back runtime changes and vice versa.

    +1 more show less

    • Stored policies use a per-policy JSON record format keyed by <name>:<namespace>:<domain>.json, capturing full YAML and enabled state.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !--release-pinned-bpf defaults to true; continuous enforcement across restarts requires explicitly setting --release-pinned-bpf=false, otherwise the previous BPF tree is removed at startup before replacement policies load.
16. docs update Jul 24, 2026 · docs issue 004

    Tetragon gains persistent gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. policies: tracing policies survive agent restarts with zero enforcement gaps via BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. handoff.

    └──▷ TRY IT
    Start Tetragon with persistent gRPC policies and zero-gap enforcement so tracing policies survive agent restarts without dropping coverage.
    copy

    $ sudo ./tetragon \
      --btf /sys/kernel/btf/vmlinux \
      --bpf-lib ./bpf/objs/ \
      --keep-sensors-on-exit \
      --release-pinned-bpf=false \
      --persist-grpc-policies \
      --persist-grpc-policies-dir /var/run/tetragon/grpc-policies

    Add a tracing policy via gRPC so it is automatically persisted to the store and survives the next agent restart.
    copy

    $ sudo ./tetra tracingpolicy add policy.yaml

    Switch a persisted policy to monitor-only mode; the store is updated so the mode is preserved after restart.
    copy

    $ sudo ./tetra tracingpolicy set-mode lsm-file-open monitor

    • New --persist-grpc-policies flag enables saving and restoring tracing policies installed via gRPC across agent restarts.
    • New --persist-grpc-policies-dir flag selects the directory used as the policy store (default: /var/run/tetragon/grpc-policies).
    • Combined with --keep-sensors-on-exit and --release-pinned-bpf=false, Tetragon performs a zero-gap BPF handoff: the old BPF tree stays attached until replacement programs are fully loaded.
    • Policy lifecycle operations (tetra tracingpolicy add/delete/enable/disable/set-mode) automatically sync the persistent store, including desired enabled state and policy mode.
    • Atomic failure handling ensures the running policy and its stored record stay consistent — failed store writes roll back runtime changes and vice versa.

    +1 more show less

    • Stored policies use a per-policy JSON record format keyed by <name>:<namespace>:<domain>.json, capturing full YAML and enabled state.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !--release-pinned-bpf defaults to true; continuous enforcement across restarts requires explicitly setting --release-pinned-bpf=false, otherwise the previous BPF tree is removed at startup before replacement policies load.
17. docs update Jul 24, 2026 · issue 024

    Tetragon now supports persistent gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. policies that survive restarts and can be restored automatically.

    • Adds persistent gRPC policies: tracing policies installed via gRPC can now be persisted and restored across restarts.

    1 detail in Everything

18. docs update Jul 24, 2026 · docs issue 004

    Tetragon now supports persistent gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. policies that survive restarts and can be restored automatically.

    • Adds persistent gRPC policies: tracing policies installed via gRPC can now be persisted and restored across restarts.

    1 detail in Everything

19. docs update Jul 24, 2026 · issue 024

    Tetragon adds in-kernel CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. expression argument filtering and uprobe override actions with register manipulation support

    • New CelExpr argument filter enables specifying Common Expression Language (CEL) expressions evaluated in-kernel for kprobe selectors, supporting arithmetic, logical, comparison operators, and 32-bit integer casting.
    • Uprobe override action now supports redirecting traced user-space symbols to a new symbol (argNewSymbol), offset (argNewOffset), or absolute address (argNewAddr) at runtime, requiring Linux 6.18+ for raw register manipulation.

    2 details in Everything

20. docs update Jul 24, 2026 · docs issue 004

    Tetragon adds in-kernel CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. expression argument filtering and uprobe override actions with register manipulation support

    • New CelExpr argument filter enables specifying Common Expression Language (CEL) expressions evaluated in-kernel for kprobe selectors, supporting arithmetic, logical, comparison operators, and 32-bit integer casting.
    • Uprobe override action now supports redirecting traced user-space symbols to a new symbol (argNewSymbol), offset (argNewOffset), or absolute address (argNewAddr) at runtime, requiring Linux 6.18+ for raw register manipulation.

    2 details in Everything

21. docs update Jul 24, 2026 · issue 024

    Tetragon uprobe policies now support binary digest verification to prevent accidental attachment to wrong binary versions.

    └──▷ USE IT
    Lock a uprobe policy to a specific binary build so it never silently attaches to an unintended version in production.
    yaml copy

    binaryDigests:
      - "sha256:1111111111111111111111111111111111111111111111111111111111111111"
      - "sha256:2222222222222222222222222222222222222222222222222222222222222222"

    • Adds binaryDigests field to uprobe tracing policies, allowing policies to validate a target binary's hash before attaching — rejecting the policy (with load_err) if the digest doesn't match.
    • Supports sha1, sha256, sha384, sha512, and ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. build-id (.note.gnu.build-id) digest types for binary verification.

    2 details in Everything

22. docs update Jul 24, 2026 · docs issue 004

    Tetragon uprobe policies now support binary digest verification to prevent accidental attachment to wrong binary versions.

    └──▷ USE IT
    Lock a uprobe policy to a specific binary build so it never silently attaches to an unintended version in production.
    yaml copy

    binaryDigests:
      - "sha256:1111111111111111111111111111111111111111111111111111111111111111"
      - "sha256:2222222222222222222222222222222222222222222222222222222222222222"

    • Adds binaryDigests field to uprobe tracing policies, allowing policies to validate a target binary's hash before attaching — rejecting the policy (with load_err) if the digest doesn't match.
    • Supports sha1, sha256, sha384, sha512, and ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. build-id (.note.gnu.build-id) digest types for binary verification.

    2 details in Everything

23. v1.7.0 Apr 29, 2026 · release notes

    Tetragon v1.7.0 adds CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine.-in-BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. evaluation, fentry sensor, env-var retrieval, host selectors, and broad uprobe enhancements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

    └──▷ TRY IT
    Use tetra explain to generate standalone CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. documentation for TracingPolicy fields without a running cluster.
    copy

    $ tetra explain tracingpolicy

    • Adds support for retrieving environment variables in kprobe/uprobe events.
    • New matchParentBinaries selector for filtering events based on ancestor process binaries.
    • Evaluates CEL expressions directly in BPF (celbpf), reducing userspace overhead for policy enforcement.
    • New fentry sensor for attaching to kernel function entry points via fentry BPF programs.
    • Adds spec.hostSelector support in TracingPolicies to target specific nodes.

    +23 more show less

    • Adds uretprobe support for uprobes, enabling return, returnArg, and args.returnCopy in uprobe policies.
    • Supports argument matching selectors (matchArgs, etc.) in uprobe policies.
    • Adds resolve: support for uprobes, enabling pointer dereference in userspace probe arguments.
    • Supports register-based data retrieval for kprobe and uprobe on supported architectures.
    • Adds current_task resolve support for uprobes.
    • Supports preloading user strings in uprobe/usdt probes.
    • Enables sleep-able USDTUSDTUserspace Statically Defined Tracing probes, a mechanism originating in Solaris and adopted by Linux, that lets a program embed named hook points so debuggers and tracers can attach at runtime with near-zero overhead when idle. argument reading.
    • Adds uprobe register override support on arm64.
    • Adds tetra explain command for standalone CRD documentation.
    • Adds node_name label to Tetragon metrics.
    • New tetragon_debug_events_total metric for non-critical BPF event tracking.
    • New consolidated tetragon_generic_kprobe_merge_total metric with status, curr_type, prev_type, curr_fn, and prev_fn labels.
    • Adds regex support for namespace filtering in export allow/deny lists.
    • Adds substring operators for selector matching.
    • Adds monitor-only mode for uprobes and stats.
    • Adds a separate configuration option for enabling ancestors in ProcessLoader events.
    • Adds process cache and execve map dumps to tetra bugtool generated tarballs.
    • Supports (u)int8int8Eight-bit integers used to represent quantized model values. They save memory compared with floating-point formats and can speed up inference on supported hardware./16 types in selectors.
    • Adds tetragon_process_cache_early_deletions_total metric for process cache GC observability.
    • Uses tracefs instead of debugfs for BPF program attachment.
    • New retprobes events cache size configuration option.
    • Adds USDT argument reading support on arm64.
    • Adds gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. info reporting for agent diagnostics.

    28 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default server-address of the agent changes from localhost:54321 to /var/run/tetragon/tetragon.sock; update all third-party programs that connect to the agent.
    • !The legacy stacktrace-tree API has been removed: the GetStackTraceTree gRPC method, tetra stacktrace-tree CLI command, and related types (GetStackTraceTreeRequest, GetStackTraceTreeResponse, stack.proto) no longer exist; use TracingPolicy with kernelStackTrace and userStackTrace in the Post action instead.
    • !The already-deprecated EnableTracingPolicy and DisableTracingPolicy gRPC methods now return an error when used; set enable-deprecated-tracingpolicy-grpc to restore old behavior until the next release removes them entirely.
    • !Metrics tetragon_generic_kprobe_merge_errors_total and tetragon_generic_kprobe_merge_ok_total have been removed and replaced by tetragon_generic_kprobe_merge_total with a status label; update any dashboards or alerts referencing the old metric names.
24. v1.6.1 Mar 31, 2026 · release notes

    Tetragon v1.6.1 adds uprobe match-args support, BTFBTFBPF Type Format, a metadata format in the Linux kernel that embeds type and debug information directly into eBPF programs, letting cyber tools inspect kernel structures safely without kernel headers at runtime. resolution for uprobes, and switches to tracefs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.1 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.6.1

    └──▷ USE IT
    Filter uprobe events by argument value — useful when you only want events for a specific argument passed to a user-space function.
    yaml copy

    spec:
      uprobes:
        - path: /usr/bin/myapp
          symbol: myFunction
          args:
            - index: 0
              type: int
          selectors:
            - matchArgs:
                - index: 0
                  operator: Equal
                  values:
                    - "42"

    • Supports matchArgs filtering in uprobe-based tracing policies.
    • Enables BTF-based type resolution for uprobe sensors.
    • Switches from debugfs to tracefs for BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. tracing attachment.
    • Allows tracing policies to load even when kptr_restrict is set to 2.

    4 details in Everything

25. v1.6.0 Oct 23, 2025 · release notes

    Tetragon v1.6.0 adds USDTUSDTUserspace Statically Defined Tracing probes, a mechanism originating in Solaris and adopted by Linux, that lets a program embed named hook points so debuggers and tracers can attach at runtime with near-zero overhead when idle. sensor, uprobe override action, ring buffer support, range filters, and per-policy action counters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    └──▷ TRY IT
    Check whether the running kernel supports the eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. features Tetragon requires before deploying policies.
    copy

    $ tetra probe config

    Override the Tetragon Operator to run as root when your environment requires it (e.g., restricted node policies).
    copy

    $ helm upgrade tetragon cilium/tetragon --set tetragonOperator.runAsRoot=true

    • Adds USDT (User Statically Defined Tracing) sensor with action support, set action, sibling argument parsing, and resolve support in USDT tracing policies.
    • Adds uprobe override action for modifying program behavior at uprobe attachment points.
    • Adds bpf_prog argument type support for kprobes, enabling introspection of BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. programs.
    • Supports BPF ring buffer as the default event transport on kernels v5.11 and later for improved performance.
    • Adds range filter support for selectors in tracing policies.

    +8 more show less

    • Adds per-policy action counters to TracingPolicy, exposing how many times each action has fired.
    • Adds pod.uid field to the Kubernetes Pod API, surfacing pod UIDs in events.
    • Adds container name regex filtering for tetra getevents.
    • Adds tetra probe config command to check kernel configuration compatibility.
    • Adds export.stdout.envFromSecrets Helm value to inject environment variables from Kubernetes Secrets into the export stdout process.
    • Adds nameOverride Helm support for the tetragon-rthooks component.
    • Enables k8s control plane metadata enrichment for non-Kubernetes (standalone) deployments.
    • Tetragon Operator now defaults to running as non-root (UID 65532); a new tetragonOperator.runAsRoot Helm option allows overriding this.

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --enable-process-ancestors boolean flag has been removed; configurations using this flag will fail on upgrade.
    • !The Tetragon Operator now runs as non-root (UID 65532) by default; workloads relying on root-based operator behavior must set tetragonOperator.runAsRoot: true to preserve the previous behavior.
26. v1.5.0 Jul 29, 2025 · release notes

    Tetragon v1.5.0 adds Windows process monitoring, raw tracepoints, uprobe actions, pod annotations/node labels in events, and a CapabilitiesGained policy operator.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    └──▷ USE IT
    Alert on any process gaining new Linux capabilities — useful for detecting privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. at runtime.
    yaml copy

    tetragon.prometheus.serviceMonitor.scrapeInterval: 60s

    • Adds Windows support for process create and exit events, enabling Tetragon to monitor process lifecycle on Windows hosts.
    • Adds raw tracepoint support in tracing policies for lower-overhead kernel event collection.
    • Enables actions (e.g., signal, override) on uprobes in tracing policies.
    • Allows uprobes to be defined with offset and ref_ctr_offset for precise attach-point control.
    • Adds pod annotations to Tetragon events, enriching process events with Kubernetes metadata.

    +12 more show less

    • Adds Kubernetes node labels to Tetragon events for richer event context.
    • Adds .process.pod.container.privileged field to PodInfo in events, surfacing container privilege status.
    • Adds CapabilitiesGained operator in tracing policy selectors to match on Linux capability escalations.
    • Adds repo key support in containerSelector within policy filters for image-repository-based policy scoping.
    • Supports IPv4-mapped IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. address form in tracing policy network selectors.
    • Adds --enable-ancestors flag to consolidate ancestor-tracking configuration across all event types.
    • Allows tracing policies to ignore kprobes for kernel symbols that cannot be found, improving policy resilience.
    • Adds path offload support for BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. programs.
    • Adds support for followChildren of older processes in matchBinaries selectors.
    • Excludes exit events from rate limiting to ensure process exit is always captured.
    • Adds tetragon.nameOverride and tetragonOperator.nameOverride Helm values for chart name customization.
    • Adds pprof CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. profile collection to the bugtool command.

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The log level string level=warning is now emitted as level=warn after the migration from logrus to log/slog; custom scripts or tools parsing Tetragon logs may need updating.
    • !The default metrics scrape interval for tetragon.prometheus.serviceMonitor.scrapeInterval and tetragonOperator.prometheus.serviceMonitor.scrapeInterval is changed from 10s to 60s.
    • !The OciHookSetup Helm section is removed (was deprecated in v1.2); any Helm values under that section will no longer be recognized.
27. v1.4.0 Mar 21, 2025 · release notes

    Tetragon v1.4 adds ancestor tracking in process events, CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. filters, monitoring mode for tracing policies, and Windows build support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    └──▷ TRY IT
    Run two Tetragon operator replicas with leader-election failover to reduce downtime during upgrades.
    copy

    $ helm upgrade tetragon cilium/tetragon --set tetragonOperator.replicas=2 --set tetragonOperator.failoverLease.enabled=true

    • Adds ancestor process information to process events, giving full lineage context for every observed action.
    • Adds attribute resolution in tracing policies for richer event enrichment.
    • Adds a monitoring mode for tracing policies, allowing policies to observe without enforcing.
    • Adds CEL filter support to the tetra CLI for client-side event filtering.
    • Adds support for struct socket and struct sockaddr as argument types in tracing policies.

    +7 more show less

    • Adds tetra policyfilter listpolicies command to list active policy filters.
    • Adds map_errors_update_total and map_errors_delete_total metrics replacing the former tetragon_map_errors_total.
    • Adds Helm values cri.enabled, cri.socketHostPath, and cgidmap.enabled for CRI socket configuration and cgroup-ID mapping, with accompanying metrics for cgidmap CRI resolution.
    • Supports running multiple Tetragon operator replicas simultaneously via tetragonOperator.replicas and tetragonOperator.failoverLease.enabled.
    • Removes the deprecated gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. sensors API.
    • Allows extending ClusterRoles and operator ConfigMap via Helm.
    • Begins Windows build support for Tetragon (Part -1).

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The tetragon_map_errors_total metric is replaced by map_errors_update_total and map_errors_delete_total; any dashboards or alerts referencing the old metric name will break.
    • !The deprecated gRPC sensors API is now removed; any client code calling those endpoints will break.
    • !The default toleration (operator: Exists) for the operator Deployment has been removed; operator pods that relied on this toleration to schedule on tainted nodes will no longer do so automatically.
28. v1.3.0 Dec 13, 2024 · release notes

    Tetragon v1.3.0 adds IMA hashes in LSM events, CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. filters, ABI-aware syscall64 events, and new process-tree tracking flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    └──▷ TRY IT
    Inspect BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. map kernel memory usage broken down by tracing policy to identify high-overhead policies.
    copy

    $ tetra tp list

    Temporarily preserve legacy syscall64 size_arg output format while updating consumers to handle the new SyscallId ABI-aware format.
    copy

    $ tetragon --enable-compatibility-syscall64-size-type

    • Adds IMA hash information to LSM events for file integrity visibility.
    • Adds support for associating pod information when nested cgroups are used.
    • Adds ABI information to syscall64 type events — output now uses a SyscallId object with id and abi fields to distinguish 64-bit and 32-bit syscalls unambiguously.
    • Adds support for tracing 32-bit ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. (aarch32) syscalls.
    • Adds all operator support (including Mask) for the syscall64 tracing policy type.

    +19 more show less

    • Adds BPF operations support in tracing policies (tracingpolicy).
    • Adds a Common Expression Language (CEL) filter for event export, including IP and CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. helper functions.
    • Adds a regex filter type for parent process arguments.
    • Introduces the in_init_tree flag on process events indicating whether a process spawned from its container's init process tree.
    • Introduces a container_id export filter and an in_init_tree export filter.
    • Exposes BPF map kernel memory use per tracing policy via the gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. API and the tetragon_tracingpolicy_kernel_memory_bytes metric.
    • Adds an optional cluster_name field to GetEventsResponse in the protobuf API.
    • Adds tetragon_enforcer_missed_notifications_total metric for the enforcer.
    • Adds metrics for LRU data cache.
    • Adds overhead metrics for BPF programs.
    • Adds version information to build information metrics.
    • Adds tetra debug progs command for inspecting loaded BPF programs.
    • Adds BPF program type information to the API.
    • Allows multiple symbol instances in kprobe specs.
    • Enables matchBinary names to use process arguments as match criteria.
    • Adds policy filter support for the cgroup tracker (cgtracker).
    • Adds shortnames and category labels for Tetragon CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it..
    • Enables tetra bash autocompletion inside the Tetragon container image.
    • Adds an enabled switch in the Helm chart to control the gops server (now disabled by default).

    24 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The syscall64 type now outputs a SyscallId object ({"syscall_id":{"id":309,"abi":"x64"}}) instead of a bare size_arg; consumers parsing raw size_arg fields will break. Use --enable-compatibility-syscall64-size-type to preserve the old behavior temporarily (flag removed in v1.4).
    • !The tetragon_ratelimit_dropped_total metric is renamed to tetragon_export_ratelimit_events_dropped_total; any dashboards or alerts referencing the old name will stop receiving data.
    • !The --expose-kernel-addresses flag has been removed; agents using this flag will fail to start.
    • !The --pprof-addr flag has been removed; agents using this flag will fail to start.
    • !The --enable-process-ancestors flag has been removed; agents using this flag will fail to start.
    • !The behavior of --export-file-perm (and Helm value tetragon.exportFilePerm) changed: on log rotation Tetragon will now enforce the specified permissions on existing export files, whereas previously existing file permissions were preserved. Verify the existing export file permissions match the configured value (default 600) before upgrading.
29. v1.2.1 Nov 27, 2024 · release notes

    Tetragon v1.2.1 adds regex filtering on parent process arguments and tunable event cache retry parameters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.1 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.2.1

    • New parent_arguments_regex filter type lets policies match events by parent process argument patterns using regular expressions.
    • Event cache retry count and delay intervals are now tunable, giving operators control over cache behavior under load.
    • Adds a cache for deleted pods to improve pod association accuracy after pod termination.
    • Adds support to dump the processLRU cache for operational introspection.
    • Adds support to exclude valid processes from processCache dumps, reducing noise during diagnostics.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The deprecated tetragon.skipCRDCreation Helm value has been removed; Helm charts referencing it will fail on upgrade.
30. v1.2.0 Sep 5, 2024 · release notes

    Tetragon v1.2.0 adds LSM sensor, username enrichment, persistent enforcement, NRI runtime hooks, and new MatchBinaries operators.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    └──▷ USE IT
    Switch the liveness probe back to tetra status after upgrading, since gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. is now the default.
    yaml copy

    tetragon:
      livenessProbe:
        timeoutSeconds: 60
        exec:
          command:
          - tetra
          - status
          - --server-address
          - "54321"
          - --retries
          - "5"

    • Adds LSM (Linux Security Module) sensor for LSM-based policy enforcement and event generation.
    • Adds username enrichment to process_exec events, resolving UIDs to login names via /proc and a local cache.
    • Supports persistent enforcement during Tetragon restarts, maintaining policy enforcement across agent lifecycle.
    • Adds NRI (Node Resource Interface) support for runtime hooks via tetragon.rthooks.
    • Adds FollowChildren attribute to MatchBinaries selector in tracing policies, enabling matching on child processes.

    +10 more show less

    • Adds Postfix and NotPostfix operators to the matchBinaries selector.
    • Adds cgroup rate support for limiting events per cgroup.
    • Adds export filter targeting parent process binary name.
    • Adds dynamic log level change option via the tetra CLI.
    • Adds tetragon_pod label to metrics via ServiceMonitor and supports extra labels on ServiceMonitors.
    • Exposes kernel ring buffer errors and Go scheduler latencies in metrics.
    • Adds missed probes metrics.
    • Adds debug Helm flag for the agent.
    • Enforces single Tetragon instance per node.
    • Adds compact print support for LSM events in tetra CLI.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The tetragonOperator.skipCRDCreation Helm value is removed; use crds.installMethod=none instead.
    • !The default liveness probe is now gRPC instead of tetra status; to keep using tetra status, specify tetragon.livenessProbe in Helm values.
    • !The tetragon_policyfilter_metrics_total metric is renamed to tetragon_policyfilter_operations_total, and its op label is renamed to operation.
    • !The tetragon_missed_events_total metric is renamed to tetragon_bpf_missed_events_total.
    • !tetragon_ringbuf_perf_event_errors_total is renamed to tetragon_observer_ringbuf_errors_total.
    • !tetragon_ringbuf_perf_event_received_total is renamed to tetragon_observer_ringbuf_events_received_total.
    • !tetragon_ringbuf_perf_event_lost_total is renamed to tetragon_observer_ringbuf_events_lost_total.
    • !tetragon_ringbuf_queue_received_total is renamed to tetragon_observer_ringbuf_queue_events_received_total.
    • !tetragon_ringbuf_queue_lost_total is renamed to tetragon_observer_ringbuf_queue_events_lost_total.
    • !tetragon_errors_total{type="process_cache_evicted"} is replaced by tetragon_process_cache_evicted_total.
    • !tetragon_errors_total{type=~"process_cache_miss_on_get|process_cache_miss_on_remove"} metrics are replaced by tetragon_process_cache_misses_total{operation=~"get|remove"}.
    • !tetragon_event_cache_<entry_type>_errors_total metrics are replaced by tetragon_event_cache_fetch_failures_total{entry_type="<entry_type>"}.
    • !tetragon_event_cache_accesses_total is renamed to tetragon_event_cache_inserts_total.
    • !tetragon_event_cache_retries_total is renamed to tetragon_event_cache_fetch_retries_total.
    • !tetragon_errors_total{type="event_missing_process_info"} is replaced by tetragon_events_missing_process_info_total.
    • !tetragon_errors_total{type="handler_error"} is removed; use tetragon_handler_errors_total instead.
    • !The sensor managing gRPC API methods ListSensors, EnableSensor, DisableSensor, and RemoveSensor are deprecated.
    • !tetragon.ociHookSetup Helm value is deprecated; use tetragon.rthooks instead.
31. v1.1.2 Jun 12, 2024 · release notes

    Tetragon v1.1.2 adds tetragon.livenessProbe Helm value and improves uid resolution via backports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.2 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.1.2

    └──▷ USE IT
    Restore the pre-v1.1.2 liveness check using the tetra status command via the new Helm value
    yaml copy

    tetragon:
      livenessProbe:
        timeoutSeconds: 60
        exec:
          command:
          - tetra
          - status
          - --server-address
          - "54321"
          - --retries

    • Adds tetragon.livenessProbe to Helm values to customize the liveness probe configuration
    • Adds uid username resolution support (backported from v1.1) to improve identity context in traces

    2 details in Everything

32. v1.1.0 Apr 29, 2024 · release notes

    Tetragon v1.1.0 adds user-space stack traces, enforcer sensor for syscall denial, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. hook support, multi-link uprobes, and redaction filters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    • TracingPolicy policy action NotifyEnforcer replaces the deprecated NotifyKiller to deny system calls via the enforcer sensor
    • Helm value crds.installMethod=none is available; the previous tetragonOperator.skipCRDCreation is deprecated
    • The policy.filter.containerSelector field allows filtering policies by container name in the TracingPolicy CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
    • TracingPolicy uprobe spec now uses the symbols array instead of the single symbol string field
    • TracingPolicy post.actions supports kernelStackTrace: true to enable kernel stack traces, replacing the old stackTrace field

    +2 more show less

    • Redaction filters are available in TracingPolicy event_redaction_filters to censor sensitive string data in process events
    • Export filters support a new filter type for process capabilities via the capabilities export filter

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Helm value tetragonOperator.skipCRDCreation is removed; use crds.installMethod=none instead.
    • !In TracingPolicy, the uprobe spec field symbol (string) is replaced with symbols (array of strings).
    • !TracingPolicy killers are renamed to enforcers; update policies to use enforcers and set action: NotifyEnforcer.
    • !In TracingPolicy, the stack trace field stackTrace is replaced with kernelStackTrace in post actions.
    • !The protobuf API field pod.labels is removed; use pod.pod_labels instead.
    • !The protobuf API event field stack_trace is renamed to kernel_stack_trace for kernel stack traces.
33. v1.0.1 Dec 18, 2023 · release notes

    Tetragon v1.0.1 adds a per-event missed events metric to detect dropped telemetry.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.1 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.0.1

34. v1.0.0 Nov 1, 2023 · release notes

    Tetragon v1.0 adds process_exec uids/gids display, killer sensor, kernel stack traces, event type filtering, namespaced policies default, and metric label filters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    • process_exec events now display uids/gids credentials and detect privileged execution
    • Adds a new killer sensor for process lifecycle detection
    • Adds an alpha feature to generate kernel stack traces for kprobe events
    • API events (kprobe, tracepoint, uprobe) now include the policy_name field
    • getevents CLI now supports filtering on event types via the new capability

    +2 more show less

    • Helm chart enables Namespaced policies and Pod label filters by default
    • Metric exporter now supports configuring labels for custom metrics

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Exported JSON files default to permissions 0600 instead of the previous default.
35. v0.11.0 Sep 1, 2023 · release notes

    Adds tetragon-operator-config ConfigMap, DeleteTracingPolicy API, and multi-kprobe overrides

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    • Adds the tetragon-operator-config ConfigMap for tetragon operator deployment configuration
    • Implements DeleteTracingPolicy functionality to remove tracing policies dynamically
    • Adds support for loading tracingpolicies from a directory instead of only CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !tracingpolicies* CRDs need to be manually deleted before upgrade
36. v0.10.0 Jul 14, 2023 · release notes

    Tetragon v0.10.0 adds socket tracking, new TracingPolicy actions (Signal/NoPost), LT/GT matchReturnArgs, and a new --tracing-policy CLI flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    • Adds Signal and NoPost actions to TracingPolicy for event control
    • Supports LT and GT operators in matchReturnArgs within TracingPolicy
    • Enables socket tracking to correlate process activity with network connections
    • Deprecates --config-file flag, replaced by --tracing-policy for loading policies
    • Adds sock and skb selectors to matchArgs for deeper packet-level filtering

    +1 more show less

    • Allows optional labels on arguments in TracingPolicy for better context in events

    6 details in Everything

37. v0.9.0 Apr 3, 2023 · release notes

    Tetragon v0.9.0 adds field filters for CLI and configmap, unix socket gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. support, pprof, tarball deployment, and cgroups tracking

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    └──▷ TRY IT
    Tune ring buffer capacity to prevent event drops during high-throughput tracing.
    copy

    $ tetragon --rb-size=131072 --rb-size-total=524288

    Filter event payload to include only specific fields, reducing bandwidth or storage cost.
    copy

    $ tetragon get-events --fields process.pid,process.name

    Access runtime profiling data without requiring a separate port mapping for standard debug tools.
    copy

    $ curl http://localhost:6060/debug/pprof/heap > profile.out

    • --rb-size and --rb-size-total CLI flags to configure BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. perf ring buffer size.
    • Add field filters to the CLI and Tetragon configmap to filter event fields.
    • Support for using Unix socket for gRPC communication instead of TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it..
    • Add pprof HTTP support for runtime profiling via standard pprof endpoints.
    • Tarball deployment support as an alternative to Kubernetes/Helm installation.

    +1 more show less

    • Basic cgroups tracking and correlation with execve events for process context.

    6 details in Everything

38. v0.8.4 Mar 3, 2023 · release notes

    Tetragon v0.8.4 adds --rb-size CLI flags, field filtering in CLI/configmap, and configurable event queue size.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.4 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v0.8.4

    • Adds --rb-size and --rb-size-total CLI options to the Tetragon agent for configuring perf ring buffer sizes
    • Adds field filter support to both the CLI output command and the Tetragon configmap to limit returned event fields

    2 details in Everything

39. v0.8.3 Oct 20, 2022 · release notes

    Tetragon v0.8.3 adds tracing for kernel capability checks, supports building on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware., and introduces the getevents stdin mode in the CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.3 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v0.8.3

    • tracing: trace capability checks performed by the kernel on X access
    • tetra: Implement getevents stdin mode
    • add InMap operator for filtering arguments
    • Add Override type in ActionSelector
    • build tetra CLI for linux arm64 and windows amd64/arm64

    5 details in Everything

40. v0.8.2 Sep 20, 2022 · release notes

    Tetragon v0.8.2 adds a benchmark application for performance validation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.2 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v0.8.2

    • tetragon bench application available for running benchmarks to measure and validate tool performance

    1 detail in Everything

41. v0.8.1 Sep 19, 2022 · release notes

    Adds -cpuprofile, memprofile, and configurable gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication./metrics ports; adds pod and argument regex filters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.1 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v0.8.1

    • Adds -cpuprofile flag to the observer binary for CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. profiling
    • Adds observer.metrics.grpcAddress and observer.metrics.grpcPort config keys via Helm to configure the gRPC metrics endpoint
    • Adds arguments_regex filter capability to TracingPolicy selectors for matching exec arguments against a regex pattern
    • Adds pod_label_filter capability to TracingPolicy selectors for matching events against pod labels

    4 details in Everything

42. v0.8.0 May 13, 2022 · release notes

    Tetragon v0.8.0 is the initial release of eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic.-based security observability and runtime enforcement for Kubernetes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.0 https://github.com/cilium/tetragon.git
    # already have the repo? check out this version:
    $ git checkout v0.8.0

    • Initial release of Tetragon, a cyber tooling component for real-time detection of process execution, privilege changes, and I/O activity using eBPF.

    1 detail in Everything