Tetragon Files

Changes from v1.7.0 to v1.7.1

total: 84 commits, prs: 52 pr commits: 84

Upgrade notes

Read the upgrade notes carefully before upgrading Tetragon. Depending on your setup, changes listed here might require a manual intervention.

TracingPolicy (k8s CRD)

returnArgAction no longer accepts Post. Use returnArg to include the return value in events, and omit returnArgAction for the default return-value behavior. Only TrackSock and UntrackSock are supported. Existing policies that set returnArgAction: "Post" should remove the field.

Changelog

Bug fixes and improvements

• Corrected total memlock reporting for aggregated maps in Bugtool and tetra debug maps by @mtardy.
• Fixed Equals selectors for dentry arguments by @3u13r.
• Enforced XValidation CEL rules when loading tracing policies in standalone mode by @mtardy.
• Added Darwin compatibility for tetragoninfo BPF probe reporting by @dangome3.
• Added int argument support for tracepoints by @sayboras.
• Fixed duplicate LSM hooks and uprobe override MatchAction handling by @FedeDP.
• Escaped special characters in user-provided strings in compact output by @mtardy.
• Applied redaction filters to all environment variables by @will-isovalent.
• Scoped uprobe and USDT events through policy filters by @sayboras.
• Prevented crashes when unsupported GetUrl or DnsLookup actions are specified in uprobe or USDT policies by @kevsecurity.
• Rejected uprobes and USDT probes in namespaced tracing policies by @sayboras.
• Improved BTF type resolution and tracing argument-read error reporting by @kkourt.
• Fixed process-cache races and reference counting, along with 32-bit CEL/BPF code generation by @kkourt.
• Allowed hostSelector without requiring enable-policy-filter by @tpapagian.
• Added btfType and btfTypeModule support by @olsajiri.
• Fixed fd_ty argument filtering to prevent spurious events by @andrewstrohman.
• Sanitized loader sensor path retrieval by @olsajiri.
• Removed spurious mbset destroy-hook warnings by @kkourt.

CI and testing

• Improved the reliability of Windows CI (initial fixes, flake mitigation) by @andrewstrohman and @ygvalent.
• Switched Windows CI to actions/checkout for the microsoft/ntosebpfext repository by @FedeDP.
• Increased the Go test job timeout to 60 minutes by @andrewstrohman.
• Updated the BUF_BREAKING_AGAINST_BRANCH configuration by @andrewstrohman.
• Skipped x86-specific tracing tests on non-x86 architectures by @3u13r.

Dependency updates

• Updated the Go toolchain and build images to v1.26.7 (toolchain updates, build image).
• Applied security updates to golang.org/x/net (github.com), containerd, golang.org/x/sys (github.com), mongo-driver, golang.org/x/text (github.com), cel-go, OpenTelemetry, and golang.org/x/mod (github.com).
• Updated controller-runtime to v0.24.0 and gRPC to v1.82.1.
• Updated the Alpine base image to v3.24.1.
• Refreshed the LVH test images (May, June, July, August, latest).