Tetragon Architecture

Tetragon Architecture An architecture diagram generated by Archify. TracingPolicy CRD · policy definition · Architecture component TracingPolicy CRD policy definition Tetragon Agent · per-node DaemonSet · Architecture component Tetragon Agent per-node DaemonSet Process tracing · exec · exit · eBPF sensors Process tracing exec · exit Network tracing · connections · sockets · eBPF sensors Network tracing connections · sockets File tracing · open · write · eBPF sensors File tracing open · write Policy enforcement load sensors eBPF sensors Legend Backend Security External

Runtime observability

  • • Records kernel events with process context
  • • Enriched with Kubernetes pod and namespace context

Policy enforcement

  • • Process kill · network block
  • • Even file-access denial executes instantly in-kernel