Changes from v1.7.0 to v1.8.0
total: 1260 commits, prs: 566 pr commits: 1259
This new release is pretty large compared to what we are used to as the number of contributors is growing within the project. See the below table for the comparison in activity of the last two previous releases.
| version | PRs | commits |
|---|---|---|
| v1.6.0 | 187 | 362 |
| v1.7.0 | 253 (+35%) | 738 (+103%) |
| v1.8.0 | 566 (+123%) | 1260 (+70%) |
It's pretty difficult to summarize all the changes that got merged in a tl;dr without skipping 90% of the content below. Each section includes a small paragraph to give you a sense of the work that was conducted and changes are triaged by areas within subsections, hopefully this should help to understand this release.
Major changes
Introduces command-line argument selectors, caller function filtering for uprobes, shared-library symbol resolution for uprobe overrides, and stateful tracing policies.
- Add
matchCmdArgsselectors to filter tracing events by individual command-line arguments of the invoking process. (https://github.com/cilium/tetragon/pull/5442) by @mtardy - Add caller function filtering to uprobe selectors in tracing policies. (https://github.com/cilium/tetragon/pull/5175) by @3u13r
- Add support for resolving uprobe
override:argNewSymbolfrom the shared library specified byoverride:sopath. (https://github.com/cilium/tetragon/pull/5563) by @FedeDP - Add support for stateful tracing policies. (https://github.com/cilium/tetragon/pull/5776) by @3u13r
Minor changes
Expand tracing policy selectors, uprobe actions, and CEL expressions, alongside improvements to process tracking, event processing, and memory usage. Add deployment options, metrics, and diagnostic capabilities.
🔎 Tracing policies and selectors
- Add domain-sharded tracing policy management. (https://github.com/cilium/tetragon/pull/4811) by @FedeDP
- Add support for the matchWorkloads selector. (https://github.com/cilium/tetragon/pull/4833) by @tpapagian
- Add SubString support for more selector argument types. (https://github.com/cilium/tetragon/pull/5030) by @litios
- Move kprobe and uprobe validation to Kubernetes XValidation markers. (https://github.com/cilium/tetragon/pull/5071) by @FedeDP
- Remove deprecated actions. (https://github.com/cilium/tetragon/pull/5090) by @FedeDP
- Add support for nodeSelector in tracing policies. (https://github.com/cilium/tetragon/pull/5189) by @sayboras
- Report node-filtered policies as skipped. (https://github.com/cilium/tetragon/pull/5257) by @sayboras
- Add support for gRPC-based persistent policies. (https://github.com/cilium/tetragon/pull/5279) by @tpapagian
- Add JSON schema and CEL validation for tracing policies without Kubernetes support. (https://github.com/cilium/tetragon/pull/5322) by @FedeDP
- Cap matchPIDs.values at 4 and bounds-check selector buffer writes. (https://github.com/cilium/tetragon/pull/5385) by @hanshal101
- Reject unknown policy members in builds without Kubernetes support. (https://github.com/cilium/tetragon/pull/5633) by @sayboras
- Fix substring matching. (https://github.com/cilium/tetragon/pull/5597) by @andrewstrohman
- Reject matchArgs/matchBinaries Postfix and NotPostfix values longer than 87 characters on kernels without large BPF program support, since such values could never match. (https://github.com/cilium/tetragon/pull/5627) by @KR-Ravindra
- Load only the selectors needed by the policy. (https://github.com/cilium/tetragon/pull/5829) by @tpapagian
- Add an eBPF-based glob library. (https://github.com/cilium/tetragon/pull/5815) by @tpapagian
- Introduce sizeFromArgIndex to replace the deprecated sizeArgIndex field that is shifted by one. (https://github.com/cilium/tetragon/pull/5921) by @mtardy
🪝 Uprobes and USDT
- Fix handling of multiple uprobes in one policy with different targets. (https://github.com/cilium/tetragon/pull/5002) by @andrewstrohman
- Check for consistency among uprobes. (https://github.com/cilium/tetragon/pull/5181) by @andrewstrohman
- Refactor addUprobe code. (https://github.com/cilium/tetragon/pull/5191) by @olsajiri
- Unify USDT selector state when there are multiple entries per hook. (https://github.com/cilium/tetragon/pull/5212) by @andrewstrohman
- Add uprobe binary digest verification. (https://github.com/cilium/tetragon/pull/5280) by @andrewstrohman
- Add argNew{Symbol,Addr,Offset} support to the uprobe override action. (https://github.com/cilium/tetragon/pull/4990) by @FedeDP
- Add partial loading for uprobe digests. (https://github.com/cilium/tetragon/pull/5301) by @andrewstrohman
- Make regs_map aware of the selector index. (https://github.com/cilium/tetragon/pull/5338) by @FedeDP
- Fix uprobe policy deletion. (https://github.com/cilium/tetragon/pull/5355) by @andrewstrohman
- Add the uprobe Set action. (https://github.com/cilium/tetragon/pull/5377) by @FedeDP
- Add symbolized user-space stack traces to ProcessUprobe events for uprobe Post actions that enable userStackTrace. (https://github.com/cilium/tetragon/pull/5696) by @rahultoppur
- Switch the per-CPU heap to a hash map for uprobe and USDT sensors. (https://github.com/cilium/tetragon/pull/5506) by @olsajiri
- Add support for u64 argValue in the uprobe Set action. (https://github.com/cilium/tetragon/pull/5706) by @FedeDP
- Use a per-selector target for uprobe Override redirects. (https://github.com/cilium/tetragon/pull/5861) by @andrewstrohman
- Add support for CEL expressions in argRegs register overrides. (https://github.com/cilium/tetragon/pull/5663) by @bar234
- Add support for multiple sopath actions in uprobes. (https://github.com/cilium/tetragon/pull/5904) by @FedeDP
🧮 CEL expressions
- Add bitwise operators for CEL expressions (and, or, xor, not). (https://github.com/cilium/tetragon/pull/5438) by @kkourt
- Add the
MatchCELselector to allow mixing arguments and data in CEL expressions. (https://github.com/cilium/tetragon/pull/5439) by @kkourt - Add bit-shifting operators for CEL expressions (lsh, rsh). (https://github.com/cilium/tetragon/pull/5549) by @bar234
- Add support for 16-bit and 8-bit signed and unsigned integers in CEL expressions. (https://github.com/cilium/tetragon/pull/5523) by @3u13r
- Add multiplication and division to CEL expressions. (https://github.com/cilium/tetragon/pull/5599) by @3u13r
📡 BPF sensors and argument handling
- Fix BTF resolution. (https://github.com/cilium/tetragon/pull/4900) by @olsajiri
- Improve argument read error status messages. (https://github.com/cilium/tetragon/pull/4978) by @andrewstrohman
- Add btfType and btfTypeModule. (https://github.com/cilium/tetragon/pull/4949) by @olsajiri
- Strengthen fentry program detection. (https://github.com/cilium/tetragon/pull/5016) by @sayboras
- Use a 64K ring buffer placeholder for compatibility with non-4K page sizes. (https://github.com/cilium/tetragon/pull/5027) by @jkubo
- Fix readArg handling for the fd_ty type. (https://github.com/cilium/tetragon/pull/5132) by @olsajiri
- Refactor register override parsing. (https://github.com/cilium/tetragon/pull/5021) by @olsajiri
- Add support for the fd type to retrieve file*. (https://github.com/cilium/tetragon/pull/5109) by @litios
- Fix sleepable_preload handling. (https://github.com/cilium/tetragon/pull/5171) by @olsajiri
- Add the --sleepable-preload-size option. (https://github.com/cilium/tetragon/pull/5282) by @olsajiri
- Use a raw tracepoint for the execve sensor. (https://github.com/cilium/tetragon/pull/5346) by @olsajiri
- Add support for multiple preloaded string-resolved arguments. (https://github.com/cilium/tetragon/pull/5330) by @FedeDP
- Remove tail calls from the execve sensor. (https://github.com/cilium/tetragon/pull/5353) by @olsajiri
- Add a read-only, frozen configuration map. (https://github.com/cilium/tetragon/pull/5214) by @olsajiri
- Reorganize match_cmd_args code. (https://github.com/cilium/tetragon/pull/5559) by @olsajiri
- Split generic process filters. (https://github.com/cilium/tetragon/pull/5647) by @olsajiri
- Release policyfilter IDs for failed policy collections. (https://github.com/cilium/tetragon/pull/5784) by @HSP18SCM23P
- Fix heap map handling. (https://github.com/cilium/tetragon/pull/5747) by @olsajiri
- Skip the task_vma iterator on kernels without support for it. (https://github.com/cilium/tetragon/pull/5913) by @sayboras
- Temporarily disable heap interrupt context. (https://github.com/cilium/tetragon/pull/5879) by @olsajiri
⚡ Process tracking and performance
- Make the size of the deleted pod LRU cache configurable and increase the default to 1024 items. Add debug logging and metrics to track evictions from the cache. (https://github.com/cilium/tetragon/pull/5252) by @mstemm
- Add the ability to disable the process cache. (https://github.com/cilium/tetragon/pull/5248) by @andrewstrohman
- Reduce allocation overhead in the BPF event read path. (https://github.com/cilium/tetragon/pull/5520) by @rafaelroquetto
- Add support for pod sandboxes in cgidmap, allowing pod sandbox IDs to be looked up by cgroup. (https://github.com/cilium/tetragon/pull/5645) by @mstemm
- Reduce allocation churn in the exec event delivery path. (https://github.com/cilium/tetragon/pull/5561) by @rafaelroquetto
- Use the ring buffer reserve API for fork and exit events. (https://github.com/cilium/tetragon/pull/5640) by @olsajiri
- Improve performance when deserializing eBPF event messages. (https://github.com/cilium/tetragon/pull/5567) by @rafaelroquetto
- Release the parent process reference atomically. (https://github.com/cilium/tetragon/pull/5804) by @sayboras
- Release exit references on event cache expiry. (https://github.com/cilium/tetragon/pull/5782) by @sayboras
- Improve the process event memory footprint. (https://github.com/cilium/tetragon/pull/5779) by @rafaelroquetto
- Add the --execve-map-no-prealloc option. (https://github.com/cilium/tetragon/pull/5891) by @rafaelroquetto
📊 Metrics, exports, and diagnostics
- Emit a warning when
monitor_onlymode is enforced. (https://github.com/cilium/tetragon/pull/4998) by @FedeDP - Add an agent flag to disable event metrics while keeping health metrics. (https://github.com/cilium/tetragon/pull/4926) by @dangome3
- Add per-selector action counters. (https://github.com/cilium/tetragon/pull/5140) by @tpapagian
- Add per-selector labels for action counters. (https://github.com/cilium/tetragon/pull/5158) by @tpapagian
- Move exportDirectory to a non-tmpfs folder. (https://github.com/cilium/tetragon/pull/5033) by @FedeDP
- Fix debug map output aggregation in bugtool. Prevent sleepable_offload from preloading and make its maximum size configurable. (https://github.com/cilium/tetragon/pull/5411) by @bar234
- Add BPF area-specific DEBUG() rodata configuration. (https://github.com/cilium/tetragon/pull/5485) by @FedeDP
- Standardize metrics labels:
opcodefor the numeric ops.OpCode, newopstrfor its readable name, andevent_typefor EventType. (https://github.com/cilium/tetragon/pull/5524) by @AritraDey-Dev - Make the redaction replacement string configurable (#5451). (https://github.com/cilium/tetragon/pull/5568) by @AboEl3iz
- Stop collecting object files in bugtool. (https://github.com/cilium/tetragon/pull/5880) by @kkourt
🚀 CLI, gRPC, and deployment
- Add the --fail-allow-namespaces-regex flag to runtime hooks. (https://github.com/cilium/tetragon/pull/4812) by @PhilipSchmid
- Add mTLS support for the Tetragon gRPC server. (https://github.com/cilium/tetragon/pull/4950) by @sayboras
- Add serviceAnnotations and serviceLabels to the Helm chart. (https://github.com/cilium/tetragon/pull/4082) by @yieon-lyon
- Disable the gops debug interface by default in the Helm chart. (https://github.com/cilium/tetragon/pull/5013) by @peoyekunle
- Fix tetra TLS client flag handling for TLS-only connections. (https://github.com/cilium/tetragon/pull/5068) by @immanuwell
- Make
tetra bugtoolreturn a non-zero exit code when archive creation fails. (https://github.com/cilium/tetragon/pull/5220) by @immanuwell - Accept redirected file stdin in
tetra getevents. (https://github.com/cilium/tetragon/pull/5253) by @immanuwell - Set hostUsers where applicable in the Helm chart. (https://github.com/cilium/tetragon/pull/5274) by @sayboras
- Run the agent unprivileged with explicit capabilities in the Helm chart. (https://github.com/cilium/tetragon/pull/5328) by @sayboras
- Add
tetra policytest run --k8sto run policy tests in a Kubernetes pod. (https://github.com/cilium/tetragon/pull/5783) by @sayboras
🛠️ Build, tests, and maintenance
- Use the standard iteration pattern. (https://github.com/cilium/tetragon/pull/5116) by @olsajiri
- Make the testKprobeObjectFileWriteHook spec more detailed. (https://github.com/cilium/tetragon/pull/5136) by @olsajiri
- Resolve tester program libraries relative to the binary. (https://github.com/cilium/tetragon/pull/5256) by @kkourt
- Apply assorted fixes. (https://github.com/cilium/tetragon/pull/5378) by @olsajiri
- Remove load tests. (https://github.com/cilium/tetragon/pull/5402) by @olsajiri
- Update the Clang build image to clang-22. (https://github.com/cilium/tetragon/pull/5583) by @sayboras
- Tidy the tools module after the root module. (https://github.com/cilium/tetragon/pull/5624) by @andrewstrohman
Bugfixes
Fix policy enforcement, event filtering and delivery, process tracking, and resource management issues. Improve agent stability, CLI behavior, Helm deployment, and platform compatibility.
🛡️ Tracing and policy enforcement
- Fix bpffs pin path collisions between same-name tracing policies from different domains, which could silently switch an enforcement policy to monitor-only. (https://github.com/cilium/tetragon/pull/5754) by @andrewstrohman
- Reject sensor pinPath escape attempts. (https://github.com/cilium/tetragon/pull/5712) by @FedeDP
- Keep LSM enforcement active after agent exit. (https://github.com/cilium/tetragon/pull/5254) by @tpapagian
- Fix crash when unsupported GetUrl or DnsLookup actions are included in uprobe or USDT tracing policies. (https://github.com/cilium/tetragon/pull/5380) by @kevsecurity
- Fix event drops (E2BIG) for uprobe/USDT policies on the single-attach path (no uprobe.multi or disable-uprobe-multi: "true"). (https://github.com/cilium/tetragon/pull/5814) by @immanuwell
- Harden namespaced tracing policies. (https://github.com/cilium/tetragon/pull/5408) by @sayboras
- Fix XValidation CEL rules not being enforced when loading tracing policies in standalone mode outside Kubernetes. (https://github.com/cilium/tetragon/pull/5065) by @mtardy
- Fix uprobe multi-hook
overrideactions being overwritten by the latest one. (https://github.com/cilium/tetragon/pull/5286) by @FedeDP - Fix handling of multiple LSM hook entries. (https://github.com/cilium/tetragon/pull/5114) by @bar234
- Return the correct LSM override value when it is not -1. (https://github.com/cilium/tetragon/pull/5827) by @3u13r
- Size the LSM override_tasks map like the kprobe sensor. (https://github.com/cilium/tetragon/pull/5857) by @sayboras
- Fix the size of the LSM ratelimit map so that rateLimit works correctly for LSM policies. (https://github.com/cilium/tetragon/pull/5817) by @rozza88
- Fix rateLimit for tracepoint, raw tracepoint, uprobe, and USDT policies. (https://github.com/cilium/tetragon/pull/5826) by @rozza88
- Scope uprobe and USDT events via policyfilter. (https://github.com/cilium/tetragon/pull/5348) by @sayboras
- Fix policy-name filtering silently dropping matching USDT events. (https://github.com/cilium/tetragon/pull/5569) by @immanuwell
- Fix uprobe events reporting the wrong symbol when a uprobe lists multiple symbols. (https://github.com/cilium/tetragon/pull/5939) by @rahultoppur
- Reject NotifyEnforcer and CleanupEnforcerNotification actions on uprobes and USDTs, where they were accepted but silently did nothing. (https://github.com/cilium/tetragon/pull/5587) by @AritraDey-Dev
- Fix argument bounds checks. (https://github.com/cilium/tetragon/pull/5514) by @andrewstrohman
- Fix the Equals selector for dentry arguments. (https://github.com/cilium/tetragon/pull/5046) by @3u13r
- Fix 32-bit arithmetic in CEL BPF expressions by using ALU32. (https://github.com/cilium/tetragon/pull/5138) by @kkourt
- Add support for int arguments in tracepoints. (https://github.com/cilium/tetragon/pull/5211) by @sayboras
- Fix generated tracing policies for zero-argument USDT probes. (https://github.com/cilium/tetragon/pull/5303) by @immanuwell
- Fix spurious kprobe spec validation warnings on clang-built kernels. (https://github.com/cilium/tetragon/pull/5625) by @AritraDey-Dev
- Use a 64-bit shift when clearing mbset bits. (https://github.com/cilium/tetragon/pull/5949) by @FedeDP
- Always consume the ima_hash action word. (https://github.com/cilium/tetragon/pull/5927) by @lifangning
⚙️ Process tracking and event handling
- Fix process cache memory leak where reused processes were not being re-queued for garbage collection. (https://github.com/cilium/tetragon/pull/5057) by @nebojsaj1726
- Fix redaction filters not applying to all environment variables. (https://github.com/cilium/tetragon/pull/5331) by @will-isovalent
- Fix malformed field filter JSON being silently ignored. (https://github.com/cilium/tetragon/pull/5219) by @immanuwell
- Add the tetragon_events_export_failed_total metric and surface JSON export write errors instead of silently counting events as exported. (https://github.com/cilium/tetragon/pull/5592) by @AdeshDeshmukh
- Fix concurrent event log parameter requests. (https://github.com/cilium/tetragon/pull/5646) by @immanuwell
- Keep an empty last argument in inline exec arguments. (https://github.com/cilium/tetragon/pull/5694) by @sayboras
- Differentiate empty execve arguments from a single empty argument. (https://github.com/cilium/tetragon/pull/5766) by @FedeDP
- Open execve_map at the configured path. (https://github.com/cilium/tetragon/pull/5770) by @sayboras
- Fix timed log rotation when its interval is set to zero. (https://github.com/cilium/tetragon/pull/5443) by @immanuwell
🔧 CLI and diagnostics
- Fix
tetra geteventspanicking when the stdin file descriptor is closed, and sort supported event types alphabetically in error messages. (https://github.com/cilium/tetragon/pull/5179) by @immanuwell - Fix
tetra geteventsstdin mode for large event lines. (https://github.com/cilium/tetragon/pull/5321) by @immanuwell - Fix tetra retry handling for zero retries and EventLog RPCs. (https://github.com/cilium/tetragon/pull/5379) by @immanuwell
- Fix
tetra statusreporting "running" before agent initialization completes.GetHealthnow returns "initializing" until the daemon finishes startup,tetra statusexposes the more detailed state, the gRPC liveness probe staysSERVING, and a gRPC startup probe now gates Kubernetes startup. (https://github.com/cilium/tetragon/pull/5603) by @stefanamaerz - Fix incorrect total memlock reporting for aggregated maps in bugtool and
tetra debug maps, where only a single instance’s memlock usage was previously shown. (https://github.com/cilium/tetragon/pull/5029) by @mtardy - Use the agent's cgroup for memory stats in bugtool. (https://github.com/cilium/tetragon/pull/5769) by @sayboras
- Reject invalid output formats for
tetra tracingpolicy domains. (https://github.com/cilium/tetragon/pull/5604) by @immanuwell - Escape special characters in user-provided strings in tetra compact encoder output. (https://github.com/cilium/tetragon/pull/5249) by @mtardy
- Fix bugs in tetra commands. (https://github.com/cilium/tetragon/pull/5187) by @mtardy
☸️ Kubernetes and Helm
- Quote Helm values rendered into manifests to prevent YAML injection. (https://github.com/cilium/tetragon/pull/5931) by @rafaelroquetto
- Adjust Helm socket mounts to survive daemon restarts for consistent metadata collection. (https://github.com/cilium/tetragon/pull/5025) by @gregswift
- Fix case-sensitive FromYAML() handling in Kubernetes builds. (https://github.com/cilium/tetragon/pull/5505) by @FedeDP
🧰 Agent stability and resource management
- Fix Tetragon startup panic when a ring buffer setting is cleared with an empty value. (https://github.com/cilium/tetragon/pull/5508) by @immanuwell
- Fix nil-pointer dereference in policyfilter. (https://github.com/cilium/tetragon/pull/5698) by @FedeDP
- Fail on unusable runtime hook specs instead of panicking. (https://github.com/cilium/tetragon/pull/5700) by @sayboras
- Fix race condition in GetEventsWG startup error handling. (https://github.com/cilium/tetragon/pull/5104) by @irozzo-1A
- Fix LoadedMapsInfo data race in TotalMemlock. (https://github.com/cilium/tetragon/pull/5058) by @sayboras
- Fix goroutine and ticker leaks by stopping abandoned aggregation loops on stream teardown. (https://github.com/cilium/tetragon/pull/5738) by @AdeshDeshmukh
- Fix GetUrl actions leaking HTTP response bodies. (https://github.com/cilium/tetragon/pull/5562) by @immanuwell
- Account for
sharedmaps when resolving sensor spec maps. (https://github.com/cilium/tetragon/pull/5736) by @FedeDP - Reduce memory and CPU usage when metrics export is disabled. (https://github.com/cilium/tetragon/pull/5512) by @rafaelroquetto
- Fix missing label and initialization for the HandlePerfEmptyData metric. (https://github.com/cilium/tetragon/pull/4943) by @lbcristaldo
- Avoid logging OpCode from its own Stringer. (https://github.com/cilium/tetragon/pull/5610) by @sayboras
🧩 BTF and platform compatibility
- Fix union and anonymous struct resolution in BTF. (https://github.com/cilium/tetragon/pull/4973) by @tdaudi
- Add support for btf.TypeTag in attribute resolution (ResolveNestedTypes). (https://github.com/cilium/tetragon/pull/5919) by @AleGredi
- Add a Darwin stub for bpfProbes in tetragoninfo. (https://github.com/cilium/tetragon/pull/4933) by @chenrui333
🧪 Tests
- Watch custom files in the matchWorkloads policyfilter test. (https://github.com/cilium/tetragon/pull/5099) by @3u13r
- Add a
WithSkipclause to the uprobe override newSymbol test. (https://github.com/cilium/tetragon/pull/5306) by @FedeDP
Documentation changes
Expand tracing policy and configuration documentation, add security guidance and examples, and improve reference accuracy. Update the website, community information, and contribution guide.
🔎 Tracing policies and configuration
- Remove the reference to followForks. (https://github.com/cilium/tetragon/pull/4959) by @andrewstrohman
- Expand the matchData section with examples and an operator reference. (https://github.com/cilium/tetragon/pull/5039) by @JoonsooWon
- Add a section for the CelExpr operator. (https://github.com/cilium/tetragon/pull/5304) by @kkourt
- Correct the enable-process-creds documentation. (https://github.com/cilium/tetragon/pull/5333) by @andrewstrohman
- Fix the documented argIndex range. (https://github.com/cilium/tetragon/pull/5509) by @andrewstrohman
- Document the namespace_regex export filter. (https://github.com/cilium/tetragon/pull/5545) by @Shireenbanu
- Add fentry/fexit sensor documentation. (https://github.com/cilium/tetragon/pull/5028) by @sayboras
🛡️ Security guidance and examples
- Add a threat model section. (https://github.com/cilium/tetragon/pull/4697) by @paularah
- Update the security reporting guidelines. (https://github.com/cilium/tetragon/pull/5299) by @ferozsalam
- Document the risks of exposing Tetragon via TCP. (https://github.com/cilium/tetragon/pull/5462) by @3u13r
- Add a tracing policy for CVE-2026-65960. (https://github.com/cilium/tetragon/pull/5396) by @paularah
- Update cosign verification instructions to support cosign v3. (https://github.com/cilium/tetragon/pull/5833) by @3u13r
🌐 Website and community
- Fix the "Cillium" typo on the landing page. (https://github.com/cilium/tetragon/pull/4958) by @Shion1305
- Add Xata as a user of Tetragon. (https://github.com/cilium/tetragon/pull/5056) by @gregswift
- Add KubeCon NA 2026 to the announcement banner. (https://github.com/cilium/tetragon/pull/5649) by @thisisobate
- Add a Lab page. (https://github.com/cilium/tetragon/pull/5513) by @paularah
- Update Hugo and Docsy to the latest versions. (https://github.com/cilium/tetragon/pull/5963) by @mtardy
📖 Contribution guide and reference corrections
- Document Tetragon's release cadence in the contribution guide. (https://github.com/cilium/tetragon/pull/5409) by @kazuru-chidumbwe
- Fix the duplicated "an" in the GetPodInfo documentation comment in process.go. (https://github.com/cilium/tetragon/pull/5003) by @lphuc2250gma
- Fix typos in events.md. (https://github.com/cilium/tetragon/pull/5019) by @allexistence
CI changes
Expand test coverage and improve reliability across Linux, Windows, and macOS builds. Refine workflows, policy tests, verifier checks, Ariane automation, and dependency update configuration.
Full CI changes (67 PRs)
### 🏗️ Workflows and build infrastructure * Fail on errors for macOS builds. (https://github.com/cilium/tetragon/pull/4936) by @dangome3 * Get the chart version before the second checkout. (https://github.com/cilium/tetragon/pull/5036) by @3u13r * Remove the deprecated artifact deletion token from workflows. (https://github.com/cilium/tetragon/pull/5067) by @3u13r * Increase the Go test job timeout to 60 minutes. (https://github.com/cilium/tetragon/pull/5100) by @sayboras * Check image tags when they are updated in Helm values. (https://github.com/cilium/tetragon/pull/5088) by @dangome3 * Set the checkout action flag to allow fork checkouts. (https://github.com/cilium/tetragon/pull/5246) by @3u13r * Fix the Helm gRPC template for CronJobs. (https://github.com/cilium/tetragon/pull/5277) by @sayboras * Skip VM test artifact deletion on fork PRs. (https://github.com/cilium/tetragon/pull/5356) by @amarkdotdev * Add a reusable tarball creation action for package end-to-end tests and VM policy tests. (https://github.com/cilium/tetragon/pull/5367) by @dangome3 * Add a reusable action to remove Azure APT mirrors. (https://github.com/cilium/tetragon/pull/5550) by @dangome3 * Add support for OIDC in CI. (https://github.com/cilium/tetragon/pull/5722) by @aanm * Remove the slow Azure APT mirror from BPF unit tests. (https://github.com/cilium/tetragon/pull/5778) by @3u13r * Use unique versions for pull request image and Helm chart builds. (https://github.com/cilium/tetragon/pull/5767) by @kingbj940429 * Remove qemu-kvm and pin CI runners to ubuntu-24. (https://github.com/cilium/tetragon/pull/5926) by @3u13r ### 🪟 Windows CI * Fix Windows eBPF CI. (https://github.com/cilium/tetragon/pull/5118) by @FedeDP * Use actions/checkout to clone microsoft/ntosebpfext in Windows CI. (https://github.com/cilium/tetragon/pull/5359) by @FedeDP * Disable automatic Windows GitHub runner upgrades. (https://github.com/cilium/tetragon/pull/5441) by @ygvalent * Address flaky Windows CI runs. (https://github.com/cilium/tetragon/pull/5479) by @ygvalent * Refactor Windows CI and fix the negative WaitGroup counter panic on Windows. (https://github.com/cilium/tetragon/pull/5525) by @ygvalent * Reduce directory listing noise in Windows CI. (https://github.com/cilium/tetragon/pull/5571) by @ygvalent ### 🧪 Test coverage and reliability * Refactor gRPC mTLS end-to-end tests. (https://github.com/cilium/tetragon/pull/5086) by @sayboras * Fix the policyfilter test build without Kubernetes support. (https://github.com/cilium/tetragon/pull/5139) by @sayboras * Add --cpu and --mem flags for vmtest. (https://github.com/cilium/tetragon/pull/5165) by @sayboras * Add arm64 policies for uprobe register tests. (https://github.com/cilium/tetragon/pull/5137) by @sayboras * Add a runtime hooks end-to-end test. (https://github.com/cilium/tetragon/pull/4937) by @3u13r * Add support for policytest in tetragon-vmtest-run. (https://github.com/cilium/tetragon/pull/5247) by @kkourt * Add randomized testing for CEL BPF expressions. (https://github.com/cilium/tetragon/pull/5362) by @kkourt * Add Go fuzz testing. (https://github.com/cilium/tetragon/pull/5554) by @3u13r * Run policytest as part of tarball test CI. (https://github.com/cilium/tetragon/pull/5589) by @FedeDP * Add a failure summary to VM tests. (https://github.com/cilium/tetragon/pull/5655) by @dangome3 * Run unit tests for the API and runtime hooks modules. (https://github.com/cilium/tetragon/pull/5713) by @sayboras * Download VM test results with gh in the summary job. (https://github.com/cilium/tetragon/pull/5740) by @dangome3 * Wait for the agent to be ready before running policy tests. (https://github.com/cilium/tetragon/pull/5763) by @andrewstrohman * Enable TestProcessCacheInterval in VM tests. (https://github.com/cilium/tetragon/pull/5773) by @sayboras * Show policytest output when tarball tests fail. (https://github.com/cilium/tetragon/pull/5834) by @3u13r * Skip tracepoint-exec in tarball policy tests. (https://github.com/cilium/tetragon/pull/5856) by @sayboras * Accept READING_MODULE_COMPRESSED in the kernel module test. (https://github.com/cilium/tetragon/pull/5875) by @sayboras * Enable `log-file` and `bpf-debug-{areas,log}` in policy tests. (https://github.com/cilium/tetragon/pull/5838) by @FedeDP * Skip syscall tracepoint tests on GitHub runners. (https://github.com/cilium/tetragon/pull/5894) by @sayboras * Add a return uprobe policy test. (https://github.com/cilium/tetragon/pull/5928) by @sayboras * Pass nil override deltas in empty-value selector tests. (https://github.com/cilium/tetragon/pull/5947) by @sayboras ### ✅ Verification and linting * Improve verifier tests. (https://github.com/cilium/tetragon/pull/5467) by @mtardy * Verify only program versions appropriate for the current kernel. (https://github.com/cilium/tetragon/pull/5510) by @mtardy * Initialize kernel BTF before probing kfuncs in verifier tests. (https://github.com/cilium/tetragon/pull/5570) by @sayboras * Improve formatting and code generation checks. (https://github.com/cilium/tetragon/pull/5473) by @3u13r * Add a whitespace linter. (https://github.com/cilium/tetragon/pull/5609) by @rafaelroquetto * Fix CodeQL lint issues in CI. (https://github.com/cilium/tetragon/pull/5897) by @dangome3 ### 🚀 Ariane automation * Add Ariane configuration and a test CI workflow. (https://github.com/cilium/tetragon/pull/5548) by @3u13r * Add action read permission to the mock Ariane workflow. (https://github.com/cilium/tetragon/pull/5623) by @3u13r * Add the /test trigger to Ariane. (https://github.com/cilium/tetragon/pull/5637) by @3u13r * Disable Ariane reactions to PR descriptions and comments. (https://github.com/cilium/tetragon/pull/5816) by @3u13r * Gate build-images-ci and its dependencies behind Ariane. (https://github.com/cilium/tetragon/pull/5812) by @3u13r * Rename the mock workflow to ariane. (https://github.com/cilium/tetragon/pull/5955) by @3u13r ### 🔄 Dependency update automation * Fix the Renovate LVH image pattern to include rhel8.10. (https://github.com/cilium/tetragon/pull/4975) by @dangome3 * Use installTools to install Go in Renovate instead of installing it manually. (https://github.com/cilium/tetragon/pull/5024) by @dangome3 * Add a Renovate rule for mikefarah/yq updates. (https://github.com/cilium/tetragon/pull/5117) by @dangome3 * Enable Renovate LVH upgrades for stable branches. (https://github.com/cilium/tetragon/pull/5203) by @sayboras * Remove matchUpdateTypes from Renovate LVH rules for stable branches. (https://github.com/cilium/tetragon/pull/5204) by @sayboras * Update all LVH images on main. (https://github.com/cilium/tetragon/pull/5196) by @sayboras * Add a dependency update cooldown in Renovate. (https://github.com/cilium/tetragon/pull/5080) by @peoyekunle * Retain the five-day Renovate cooldown for official Docker Hub images. (https://github.com/cilium/tetragon/pull/5498) by @peoyekunle * Group golangci-lint upgrades together in Renovate. (https://github.com/cilium/tetragon/pull/5558) by @mtardy * Allow Renovate to update .github/actions. (https://github.com/cilium/tetragon/pull/5575) by @ygvalent * Extend Renovate discovery to nested action directories. (https://github.com/cilium/tetragon/pull/5588) by @ygvalent * Apply Renovate fixes and reverts. (https://github.com/cilium/tetragon/pull/5586) by @mtardy * Add Renovate configuration for bpftool. (https://github.com/cilium/tetragon/pull/5653) by @sayboras * Fix the scope of the Renovate GitHub Actions dependency group. (https://github.com/cilium/tetragon/pull/5723) by @mtardyMisc changes
Refine BPF internals, process tracking, agent lifecycle handling, and diagnostics. Improve test utilities, simplify dependencies, and maintain build configuration and repository tooling.
Full miscellaneous changes (88 PRs)
### 🔎 Tracing policies and BPF internals * Use kubebuilder XValidation for spec.hostSelector. (https://github.com/cilium/tetragon/pull/4947) by @tpapagian * Fix spurious mbset destroy hook warnings. (https://github.com/cilium/tetragon/pull/4954) by @kkourt * Simplify copy_char_buf. (https://github.com/cilium/tetragon/pull/5018) by @3u13r * Use void *ctx for fentry/fexit programs. (https://github.com/cilium/tetragon/pull/5034) by @sayboras * Skip the fentry load probe on amd64. (https://github.com/cilium/tetragon/pull/5062) by @sayboras * Add errmetrics to more BPF function calls. (https://github.com/cilium/tetragon/pull/4989) by @3u13r * Replace selected bpf_probe_read calls. (https://github.com/cilium/tetragon/pull/5073) by @3u13r * Export the {k8s,grpc,static}domains constants. (https://github.com/cilium/tetragon/pull/5202) by @FedeDP * Stop requiring enable-policy-filter for hostSelector. (https://github.com/cilium/tetragon/pull/5218) by @tpapagian * Export an ELF build-id parser for raw notes. (https://github.com/cilium/tetragon/pull/5263) by @sayboras * Link uprobe targets by file descriptor. (https://github.com/cilium/tetragon/pull/5182) by @andrewstrohman * Fix typos in the KProbeSelector and ArgSelector CRD documentation. (https://github.com/cilium/tetragon/pull/5283) by @3u13r * Refactor duplicate sensor instance code. (https://github.com/cilium/tetragon/pull/5161) by @FedeDP * Restore BPF programs on failure during policy restore. (https://github.com/cilium/tetragon/pull/5412) by @tpapagian * Reduce `filter_arg` program complexity on recent kernels (6.1+). (https://github.com/cilium/tetragon/pull/5491) by @mtardy * Apply follow-up changes to matchCmdArgs. (https://github.com/cilium/tetragon/pull/5531) by @mtardy * Write retprobe errors before map calls in copy_char_buf/iovec. (https://github.com/cilium/tetragon/pull/5605) by @dangome3 * Validate tracepoint subsystem and event names in tracing policies. (https://github.com/cilium/tetragon/pull/5743) by @andrewstrohman * Fix the warning when forcing monitor_only mode. (https://github.com/cilium/tetragon/pull/5895) by @kkourt * Remove fdinstall_map leftovers. (https://github.com/cilium/tetragon/pull/5896) by @FedeDP * Pin LSM programs with different names. (https://github.com/cilium/tetragon/pull/5889) by @kkourt * Reject empty values in NUL-strip selectors during policy parsing to prevent agent crashes on empty matchArgs values. (https://github.com/cilium/tetragon/pull/5657) by @AdeshDeshmukh ### ⚙️ Process tracking and agent lifecycle * Use atomic access for the color field in ProcessInternal. (https://github.com/cilium/tetragon/pull/5106) by @arpitjain099 * Add a missing guard for GetPodInfo to avoid collecting Kubernetes pod metadata in deployments without Kubernetes. (https://github.com/cilium/tetragon/pull/5446) by @t0x01 * Check for Kubernetes before looking up pod information. (https://github.com/cilium/tetragon/pull/5459) by @andrewstrohman * Exit cleanly when SIGTERM arrives during startup. (https://github.com/cilium/tetragon/pull/5626) by @stefanamaerz * Fix field-filter failure handling to drop and count the affected event instead of delivering unfiltered data. (https://github.com/cilium/tetragon/pull/5716) by @AdeshDeshmukh * Add HEALTH_STATUS_INITIALIZING and report it from the GetHealth API while the agent is starting, instead of HEALTH_STATUS_UNDEF. (https://github.com/cilium/tetragon/pull/5810) by @stefanamaerz * Ensure process and event caches exit cleanly when the context is done. (https://github.com/cilium/tetragon/pull/5780) by @FedeDP * Add failure information when criResolver fails. (https://github.com/cilium/tetragon/pull/5887) by @kkourt * Allow a nil error from Policyhandler on Windows. (https://github.com/cilium/tetragon/pull/5911) by @ExceptionalHandler * Avoid an empty sandboxID in cgidmap. (https://github.com/cilium/tetragon/pull/5920) by @kkourt ### 🔧 CLI, configuration, and diagnostics * Improve the sysrq-trigger shutdown failure log in tetragon-tester. (https://github.com/cilium/tetragon/pull/5001) by @JoonsooWon * Skip malformed JSON lines from stdin in `tetra getevents` instead of emitting empty events. (https://github.com/cilium/tetragon/pull/5173) by @immanuwell * Propagate errors correctly in tetra CLI commands. (https://github.com/cilium/tetragon/pull/5188) by @mtardy * Add enum-like flags. (https://github.com/cilium/tetragon/pull/5258) by @FedeDP * Validate export-rate-limit and warn on invalid or zero values. (https://github.com/cilium/tetragon/pull/5300) by @stefanamaerz * Simplify creating gRPC clients for Tetragon. (https://github.com/cilium/tetragon/pull/5422) by @mstemm * Return metrics bind errors and support graceful metrics shutdown. (https://github.com/cilium/tetragon/pull/5399) by @stefanamaerz * Fix misleading pprof logs when bugtool runs without gops. (https://github.com/cilium/tetragon/pull/5329) by @Ehtasham-Yasin * Port `--enable-ancestors` to `SliceEnum`. (https://github.com/cilium/tetragon/pull/5708) by @FedeDP * Extend `bugtool` to report the agent log when it exists. (https://github.com/cilium/tetragon/pull/5711) by @FedeDP * Gather the agent's open file descriptors in bugtool. (https://github.com/cilium/tetragon/pull/5831) by @sayboras * Add a 'tetragon.environment.extra' helper function to the Helm chart to extend the Tetragon container environment in other distributions of the chart. (https://github.com/cilium/tetragon/pull/5924) by @mstemm ### 🧪 Tests and verification * Use testing/synctest for deterministic time in tests. (https://github.com/cilium/tetragon/pull/4979) by @sayboras * Add a method to remove a single pod from the fake watcher. (https://github.com/cilium/tetragon/pull/4996) by @mstemm * Test resolution of nested anonymous structs. (https://github.com/cilium/tetragon/pull/4987) by @andrewstrohman * Add a log message on Tetragon installation failure in end-to-end tests. (https://github.com/cilium/tetragon/pull/5035) by @kkourt * Skip x86-specific tracing tests on non-x86 architectures. (https://github.com/cilium/tetragon/pull/5082) by @3u13r * Refactor the loader test. (https://github.com/cilium/tetragon/pull/5183) by @andrewstrohman * Update policy tests. (https://github.com/cilium/tetragon/pull/5255) by @kkourt * Apply further policy test updates. (https://github.com/cilium/tetragon/pull/5312) by @kkourt * Fix `policytest run`. (https://github.com/cilium/tetragon/pull/5326) by @andrewstrohman * Disable process cache tests. (https://github.com/cilium/tetragon/pull/5354) by @andrewstrohman * Add policy test validation checks for builds without Kubernetes support. (https://github.com/cilium/tetragon/pull/5463) by @dangome3 * Add `--verifier-log-level` for Go tests to replace the previous flag name. (https://github.com/cilium/tetragon/pull/5517) by @mtardy * Improve policy tests. (https://github.com/cilium/tetragon/pull/5595) by @kkourt * Enhance policy tests. (https://github.com/cilium/tetragon/pull/5566) by @andrewstrohman * Compare object kernel versions numerically in verifier tests. (https://github.com/cilium/tetragon/pull/5724) by @sayboras * Remove containerd/cgroups from the policyfilter test. (https://github.com/cilium/tetragon/pull/5807) by @sayboras * Restore the `testify/assert` import in lsm_test. (https://github.com/cilium/tetragon/pull/5874) by @FedeDP * Add regular expression matching for policy test names. (https://github.com/cilium/tetragon/pull/5859) by @FedeDP * Run multiple policy tests. (https://github.com/cilium/tetragon/pull/5881) by @kkourt * Rewrite TestUretprobeGeneric using policytest. (https://github.com/cilium/tetragon/pull/5960) by @andrewstrohman ### 🛠️ Build and dependency maintenance * Keep pinned digests unchanged for selected Go modules. (https://github.com/cilium/tetragon/pull/4941) by @andrewstrohman * Schedule Renovate LVH updates monthly for stable branches. (https://github.com/cilium/tetragon/pull/5278) by @sayboras * Add support for building against clang-22. (https://github.com/cilium/tetragon/pull/5453) by @rafaelroquetto * Apply small fixes identified by Clang analysis. (https://github.com/cilium/tetragon/pull/5596) by @kevsecurity * Use new packages and functions in Go 1.27. (https://github.com/cilium/tetragon/pull/5632) by @sayboras * Update the Go version for stable branches in Renovate. (https://github.com/cilium/tetragon/pull/5634) by @sayboras * Replace golang-set with a plain map in filters. (https://github.com/cilium/tetragon/pull/5674) by @sayboras * Replace multierr with errors.Join. (https://github.com/cilium/tetragon/pull/5676) by @sayboras * Exclude everything by default in .dockerignore. (https://github.com/cilium/tetragon/pull/5688) by @sayboras * Simplify development tool dependencies. (https://github.com/cilium/tetragon/pull/5683) by @sayboras * Replace gjson with encoding/json in CRI handling. (https://github.com/cilium/tetragon/pull/5681) by @sayboras * Watch TLS files without controller-runtime in certloader. (https://github.com/cilium/tetragon/pull/5613) by @sayboras * Use Clang 22 for formatting and CI. (https://github.com/cilium/tetragon/pull/5682) by @sayboras * Remove github.com/containers/common from runtime hooks. (https://github.com/cilium/tetragon/pull/5806) by @sayboras * Avoid running apt-get update separately in the Dockerfile. (https://github.com/cilium/tetragon/pull/5914) by @kkourt ### 🧹 Repository maintenance and refactoring * Update CODEOWNERS with the new specialized review teams. (https://github.com/cilium/tetragon/pull/5000) by @mtardy * Adjust the tetragon-docs Markdown file rule in CODEOWNERS. (https://github.com/cilium/tetragon/pull/5010) by @mtardy * Add Cilium's generative AI policy to the PR template. (https://github.com/cilium/tetragon/pull/5032) by @kkourt * Apply various small bug fixes. (https://github.com/cilium/tetragon/pull/5077) by @mtardy * Migrate Kubernetes handling to controller-runtime reconcilers and an abstract informer pattern. (https://github.com/cilium/tetragon/pull/4977) by @sayboras * Add sloglint settings. (https://github.com/cilium/tetragon/pull/5125) by @3u13r * Stop requesting tetragon-windows review on vendored files. (https://github.com/cilium/tetragon/pull/5433) by @mtardy * Automatically generate more unset code in protoc-gen. (https://github.com/cilium/tetragon/pull/5410) by @andrewstrohman * Prepare for the v1.8.0 release. (https://github.com/cilium/tetragon/pull/5982) by @mtardyDependency updates
Update Go, Kubernetes, container runtime dependencies, and supporting libraries, including security fixes. Refresh build tools, container images, Helm charts, GitHub Actions, and VM test images.
