Restrict Access to Secure Files with Tetragon

Write Tetragon TracingPolicy CRDs with kprobes to observe file access in a Kubernetes cluster, then filter on sys_write and paths under /etc using matchArgs, and enforce policy in-kernel with the SIGKILL and getURL match actions.