Changes from v1.7.0 to v1.8.0
total: 1260 commits, prs: 566 pr commits: 1259
This new release is pretty large compared to what we are used to as the number of contributors is growing within the project. See the below table for the comparison in activity of the last two previous releases.
| version | PRs | commits |
|---|---|---|
| v1.6.0 | 187 | 362 |
| v1.7.0 | 253 (+35%) | 738 (+103%) |
| v1.8.0 | 566 (+123%) | 1260 (+70%) |
It's pretty difficult to summarize all the changes that got merged in a tl;dr without skipping 90% of the content below. Each section includes a small paragraph to give you a sense of the work that was conducted and changes are triaged by areas within subsections, hopefully this should help to understand this release.
Major changes
Introduces command-line argument selectors, caller function filtering for uprobes, shared-library symbol resolution for uprobe overrides, and stateful tracing policies.
- Add
matchCmdArgsselectors to filter tracing events by individual command-line arguments of the invoking process. (#5442) by @mtardy - Add caller function filtering to uprobe selectors in tracing policies. (#5175) by @3u13r
- Add support for resolving uprobe
override:argNewSymbolfrom the shared library specified byoverride:sopath. (#5563) by @FedeDP - Add support for stateful tracing policies. (#5776) by @3u13r
Minor changes
Expand tracing policy selectors, uprobe actions, and CEL expressions, alongside improvements to process tracking, event processing, and memory usage. Add deployment options, metrics, and diagnostic capabilities.
🔎 Tracing policies and selectors
- Add domain-sharded tracing policy management. (#4811) by @FedeDP
- Add support for the matchWorkloads selector. (#4833) by @tpapagian
- Add SubString support for more selector argument types. (#5030) by @litios
- Move kprobe and uprobe validation to Kubernetes XValidation markers. (#5071) by @FedeDP
- Remove deprecated actions. (#5090) by @FedeDP
- Add support for nodeSelector in tracing policies. (#5189) by @sayboras
- Report node-filtered policies as skipped. (#5257) by @sayboras
- Add support for gRPC-based persistent policies. (#5279) by @tpapagian
- Add JSON schema and CEL validation for tracing policies without Kubernetes support. (#5322) by @FedeDP
- Cap matchPIDs.values at 4 and bounds-check selector buffer writes. (#5385) by @hanshal101
- Reject unknown policy members in builds without Kubernetes support. (#5633) by @sayboras
- Fix substring matching. (#5597) by @andrewstrohman
- Reject matchArgs/matchBinaries Postfix and NotPostfix values longer than 87 characters on kernels without large BPF program support, since such values could never match. (#5627) by @KR-Ravindra
- Load only the selectors needed by the policy. (#5829) by @tpapagian
- Add an eBPF-based glob library. (#5815) by @tpapagian
- Introduce sizeFromArgIndex to replace the deprecated sizeArgIndex field that is shifted by one. (#5921) by @mtardy
🪝 Uprobes and USDT
- Fix handling of multiple uprobes in one policy with different targets. (#5002) by @andrewstrohman
- Check for consistency among uprobes. (#5181) by @andrewstrohman
- Refactor addUprobe code. (#5191) by @olsajiri
- Unify USDT selector state when there are multiple entries per hook. (#5212) by @andrewstrohman
- Add uprobe binary digest verification. (#5280) by @andrewstrohman
- Add argNew{Symbol,Addr,Offset} support to the uprobe override action. (#4990) by @FedeDP
- Add partial loading for uprobe digests. (#5301) by @andrewstrohman
- Make regs_map aware of the selector index. (#5338) by @FedeDP
- Fix uprobe policy deletion. (#5355) by @andrewstrohman
- Add the uprobe Set action. (#5377) by @FedeDP
- Add symbolized user-space stack traces to ProcessUprobe events for uprobe Post actions that enable userStackTrace. (#5696) by @rahultoppur
- Switch the per-CPU heap to a hash map for uprobe and USDT sensors. (#5506) by @olsajiri
- Add support for u64 argValue in the uprobe Set action. (#5706) by @FedeDP
- Use a per-selector target for uprobe Override redirects. (#5861) by @andrewstrohman
- Add support for CEL expressions in argRegs register overrides. (#5663) by @bar234
- Add support for multiple sopath actions in uprobes. (#5904) by @FedeDP
🧮 CEL expressions
- Add bitwise operators for CEL expressions (and, or, xor, not). (#5438) by @kkourt
- Add the
MatchCELselector to allow mixing arguments and data in CEL expressions. (#5439) by @kkourt - Add bit-shifting operators for CEL expressions (lsh, rsh). (#5549) by @bar234
- Add support for 16-bit and 8-bit signed and unsigned integers in CEL expressions. (#5523) by @3u13r
- Add multiplication and division to CEL expressions. (#5599) by @3u13r
📡 BPF sensors and argument handling
- Fix BTF resolution. (#4900) by @olsajiri
- Improve argument read error status messages. (#4978) by @andrewstrohman
- Add btfType and btfTypeModule. (#4949) by @olsajiri
- Strengthen fentry program detection. (#5016) by @sayboras
- Use a 64K ring buffer placeholder for compatibility with non-4K page sizes. (#5027) by @jkubo
- Fix readArg handling for the fd_ty type. (#5132) by @olsajiri
- Refactor register override parsing. (#5021) by @olsajiri
- Add support for the fd type to retrieve file*. (#5109) by @litios
- Fix sleepable_preload handling. (#5171) by @olsajiri
- Add the --sleepable-preload-size option. (#5282) by @olsajiri
- Use a raw tracepoint for the execve sensor. (#5346) by @olsajiri
- Add support for multiple preloaded string-resolved arguments. (#5330) by @FedeDP
- Remove tail calls from the execve sensor. (#5353) by @olsajiri
- Add a read-only, frozen configuration map. (#5214) by @olsajiri
- Reorganize match_cmd_args code. (#5559) by @olsajiri
- Split generic process filters. (#5647) by @olsajiri
- Release policyfilter IDs for failed policy collections. (#5784) by @HSP18SCM23P
- Fix heap map handling. (#5747) by @olsajiri
- Skip the task_vma iterator on kernels without support for it. (#5913) by @sayboras
- Temporarily disable heap interrupt context. (#5879) by @olsajiri
⚡ Process tracking and performance
- Make the size of the deleted pod LRU cache configurable and increase the default to 1024 items. Add debug logging and metrics to track evictions from the cache. (#5252) by @mstemm
- Add the ability to disable the process cache. (#5248) by @andrewstrohman
- Reduce allocation overhead in the BPF event read path. (#5520) by @rafaelroquetto
- Add support for pod sandboxes in cgidmap, allowing pod sandbox IDs to be looked up by cgroup. (#5645) by @mstemm
- Reduce allocation churn in the exec event delivery path. (#5561) by @rafaelroquetto
- Use the ring buffer reserve API for fork and exit events. (#5640) by @olsajiri
- Improve performance when deserializing eBPF event messages. (#5567) by @rafaelroquetto
- Release the parent process reference atomically. (#5804) by @sayboras
- Release exit references on event cache expiry. (#5782) by @sayboras
- Improve the process event memory footprint. (#5779) by @rafaelroquetto
- Add the --execve-map-no-prealloc option. (#5891) by @rafaelroquetto
📊 Metrics, exports, and diagnostics
- Emit a warning when
monitor_onlymode is enforced. (#4998) by @FedeDP - Add an agent flag to disable event metrics while keeping health metrics. (#4926) by @dangome3
- Add per-selector action counters. (#5140) by @tpapagian
- Add per-selector labels for action counters. (#5158) by @tpapagian
- Move exportDirectory to a non-tmpfs folder. (#5033) by @FedeDP
- Fix debug map output aggregation in bugtool. Prevent sleepable_offload from preloading and make its maximum size configurable. (#5411) by @bar234
- Add BPF area-specific DEBUG() rodata configuration. (#5485) by @FedeDP
- Standardize metrics labels:
opcodefor the numeric ops.OpCode, newopstrfor its readable name, andevent_typefor EventType. (#5524) by @AritraDey-Dev - Make the redaction replacement string configurable (#5451). (#5568) by @AboEl3iz
- Stop collecting object files in bugtool. (#5880) by @kkourt
🚀 CLI, gRPC, and deployment
- Add the --fail-allow-namespaces-regex flag to runtime hooks. (#4812) by @PhilipSchmid
- Add mTLS support for the Tetragon gRPC server. (#4950) by @sayboras
- Add serviceAnnotations and serviceLabels to the Helm chart. (#4082) by @yieon-lyon
- Disable the gops debug interface by default in the Helm chart. (#5013) by @peoyekunle
- Fix tetra TLS client flag handling for TLS-only connections. (#5068) by @immanuwell
- Make
tetra bugtoolreturn a non-zero exit code when archive creation fails. (#5220) by @immanuwell - Accept redirected file stdin in
tetra getevents. (#5253) by @immanuwell - Set hostUsers where applicable in the Helm chart. (#5274) by @sayboras
- Run the agent unprivileged with explicit capabilities in the Helm chart. (#5328) by @sayboras
- Add
tetra policytest run --k8sto run policy tests in a Kubernetes pod. (#5783) by @sayboras
🛠️ Build, tests, and maintenance
- Use the standard iteration pattern. (#5116) by @olsajiri
- Make the testKprobeObjectFileWriteHook spec more detailed. (#5136) by @olsajiri
- Resolve tester program libraries relative to the binary. (#5256) by @kkourt
- Apply assorted fixes. (#5378) by @olsajiri
- Remove load tests. (#5402) by @olsajiri
- Update the Clang build image to clang-22. (#5583) by @sayboras
- Tidy the tools module after the root module. (#5624) by @andrewstrohman
Bugfixes
Fix policy enforcement, event filtering and delivery, process tracking, and resource management issues. Improve agent stability, CLI behavior, Helm deployment, and platform compatibility.
🛡️ Tracing and policy enforcement
- Fix bpffs pin path collisions between same-name tracing policies from different domains, which could silently switch an enforcement policy to monitor-only. (#5754) by @andrewstrohman
- Reject sensor pinPath escape attempts. (#5712) by @FedeDP
- Keep LSM enforcement active after agent exit. (#5254) by @tpapagian
- Fix crash when unsupported GetUrl or DnsLookup actions are included in uprobe or USDT tracing policies. (#5380) by @kevsecurity
- Fix event drops (E2BIG) for uprobe/USDT policies on the single-attach path (no uprobe.multi or disable-uprobe-multi: "true"). (#5814) by @immanuwell
- Harden namespaced tracing policies. (#5408) by @sayboras
- Fix XValidation CEL rules not being enforced when loading tracing policies in standalone mode outside Kubernetes. (#5065) by @mtardy
- Fix uprobe multi-hook
overrideactions being overwritten by the latest one. (#5286) by @FedeDP - Fix handling of multiple LSM hook entries. (#5114) by @bar234
- Return the correct LSM override value when it is not -1. (#5827) by @3u13r
- Size the LSM override_tasks map like the kprobe sensor. (#5857) by @sayboras
- Fix the size of the LSM ratelimit map so that rateLimit works correctly for LSM policies. (#5817) by @rozza88
- Fix rateLimit for tracepoint, raw tracepoint, uprobe, and USDT policies. (#5826) by @rozza88
- Scope uprobe and USDT events via policyfilter. (#5348) by @sayboras
- Fix policy-name filtering silently dropping matching USDT events. (#5569) by @immanuwell
- Fix uprobe events reporting the wrong symbol when a uprobe lists multiple symbols. (#5939) by @rahultoppur
- Reject NotifyEnforcer and CleanupEnforcerNotification actions on uprobes and USDTs, where they were accepted but silently did nothing. (#5587) by @AritraDey-Dev
- Fix argument bounds checks. (#5514) by @andrewstrohman
- Fix the Equals selector for dentry arguments. (#5046) by @3u13r
- Fix 32-bit arithmetic in CEL BPF expressions by using ALU32. (#5138) by @kkourt
- Add support for int arguments in tracepoints. (#5211) by @sayboras
- Fix generated tracing policies for zero-argument USDT probes. (#5303) by @immanuwell
- Fix spurious kprobe spec validation warnings on clang-built kernels. (#5625) by @AritraDey-Dev
- Use a 64-bit shift when clearing mbset bits. (#5949) by @FedeDP
- Always consume the ima_hash action word. (#5927) by @lifangning
⚙️ Process tracking and event handling
- Fix process cache memory leak where reused processes were not being re-queued for garbage collection. (#5057) by @nebojsaj1726
- Fix redaction filters not applying to all environment variables. (#5331) by @will-isovalent
- Fix malformed field filter JSON being silently ignored. (#5219) by @immanuwell
- Add the tetragon_events_export_failed_total metric and surface JSON export write errors instead of silently counting events as exported. (#5592) by @AdeshDeshmukh
- Fix concurrent event log parameter requests. (#5646) by @immanuwell
- Keep an empty last argument in inline exec arguments. (#5694) by @sayboras
- Differentiate empty execve arguments from a single empty argument. (#5766) by @FedeDP
- Open execve_map at the configured path. (#5770) by @sayboras
- Fix timed log rotation when its interval is set to zero. (#5443) by @immanuwell
🔧 CLI and diagnostics
- Fix
tetra geteventspanicking when the stdin file descriptor is closed, and sort supported event types alphabetically in error messages. (#5179) by @immanuwell - Fix
tetra geteventsstdin mode for large event lines. (#5321) by @immanuwell - Fix tetra retry handling for zero retries and EventLog RPCs. (#5379) by @immanuwell
- Fix
tetra statusreporting "running" before agent initialization completes.GetHealthnow returns "initializing" until the daemon finishes startup,tetra statusexposes the more detailed state, the gRPC liveness probe staysSERVING, and a gRPC startup probe now gates Kubernetes startup. (#5603) by @stefanamaerz - Fix incorrect total memlock reporting for aggregated maps in bugtool and
tetra debug maps, where only a single instance’s memlock usage was previously shown. (#5029) by @mtardy - Use the agent's cgroup for memory stats in bugtool. (#5769) by @sayboras
- Reject invalid output formats for
tetra tracingpolicy domains. (#5604) by @immanuwell - Escape special characters in user-provided strings in tetra compact encoder output. (#5249) by @mtardy
- Fix bugs in tetra commands. (#5187) by @mtardy
☸️ Kubernetes and Helm
- Quote Helm values rendered into manifests to prevent YAML injection. (#5931) by @rafaelroquetto
- Adjust Helm socket mounts to survive daemon restarts for consistent metadata collection. (#5025) by @gregswift
- Fix case-sensitive FromYAML() handling in Kubernetes builds. (#5505) by @FedeDP
🧰 Agent stability and resource management
- Fix Tetragon startup panic when a ring buffer setting is cleared with an empty value. (#5508) by @immanuwell
- Fix nil-pointer dereference in policyfilter. (#5698) by @FedeDP
- Fail on unusable runtime hook specs instead of panicking. (#5700) by @sayboras
- Fix race condition in GetEventsWG startup error handling. (#5104) by @irozzo-1A
- Fix LoadedMapsInfo data race in TotalMemlock. (#5058) by @sayboras
- Fix goroutine and ticker leaks by stopping abandoned aggregation loops on stream teardown. (#5738) by @AdeshDeshmukh
- Fix GetUrl actions leaking HTTP response bodies. (#5562) by @immanuwell
- Account for
sharedmaps when resolving sensor spec maps. (#5736) by @FedeDP - Reduce memory and CPU usage when metrics export is disabled. (#5512) by @rafaelroquetto
- Fix missing label and initialization for the HandlePerfEmptyData metric. (#4943) by @lbcristaldo
- Avoid logging OpCode from its own Stringer. (#5610) by @sayboras
🧩 BTF and platform compatibility
- Fix union and anonymous struct resolution in BTF. (#4973) by @tdaudi
- Add support for btf.TypeTag in attribute resolution (ResolveNestedTypes). (#5919) by @AleGredi
- Add a Darwin stub for bpfProbes in tetragoninfo. (#4933) by @chenrui333
🧪 Tests
- Watch custom files in the matchWorkloads policyfilter test. (#5099) by @3u13r
- Add a
WithSkipclause to the uprobe override newSymbol test. (#5306) by @FedeDP
Documentation changes
Expand tracing policy and configuration documentation, add security guidance and examples, and improve reference accuracy. Update the website, community information, and contribution guide.
🔎 Tracing policies and configuration
- Remove the reference to followForks. (#4959) by @andrewstrohman
- Expand the matchData section with examples and an operator reference. (#5039) by @JoonsooWon
- Add a section for the CelExpr operator. (#5304) by @kkourt
- Correct the enable-process-creds documentation. (#5333) by @andrewstrohman
- Fix the documented argIndex range. (#5509) by @andrewstrohman
- Document the namespace_regex export filter. (#5545) by @Shireenbanu
- Add fentry/fexit sensor documentation. (#5028) by @sayboras
🛡️ Security guidance and examples
- Add a threat model section. (#4697) by @paularah
- Update the security reporting guidelines. (#5299) by @ferozsalam
- Document the risks of exposing Tetragon via TCP. (#5462) by @3u13r
- Add a tracing policy for CVE-2026-65960. (#5396) by @paularah
- Update cosign verification instructions to support cosign v3. (#5833) by @3u13r
🌐 Website and community
- Fix the "Cillium" typo on the landing page. (#4958) by @Shion1305
- Add Xata as a user of Tetragon. (#5056) by @gregswift
- Add KubeCon NA 2026 to the announcement banner. (#5649) by @thisisobate
- Add a Lab page. (#5513) by @paularah
- Update Hugo and Docsy to the latest versions. (#5963) by @mtardy
📖 Contribution guide and reference corrections
- Document Tetragon's release cadence in the contribution guide. (#5409) by @kazuru-chidumbwe
- Fix the duplicated "an" in the GetPodInfo documentation comment in process.go. (#5003) by @lphuc2250gma
- Fix typos in events.md. (#5019) by @allexistence
CI changes
Expand test coverage and improve reliability across Linux, Windows, and macOS builds. Refine workflows, policy tests, verifier checks, Ariane automation, and dependency update configuration.
Full CI changes (67 PRs)
🏗️ Workflows and build infrastructure
🪟 Windows CI
🧪 Test coverage and reliability
log-file and bpf-debug-{areas,log} in policy tests. (#5838) by @FedeDP
✅ Verification and linting
🚀 Ariane automation
🔄 Dependency update automation
Misc changes
Refine BPF internals, process tracking, agent lifecycle handling, and diagnostics. Improve test utilities, simplify dependencies, and maintain build configuration and repository tooling.
Full miscellaneous changes (88 PRs)
🔎 Tracing policies and BPF internals
filter_arg program complexity on recent kernels (6.1+). (#5491) by @mtardy
⚙️ Process tracking and agent lifecycle
🔧 CLI, configuration, and diagnostics
tetra getevents instead of emitting empty events. (#5173) by @immanuwell
--enable-ancestors to SliceEnum. (#5708) by @FedeDP
bugtool to report the agent log when it exists. (#5711) by @FedeDP
🧪 Tests and verification
policytest run. (#5326) by @andrewstrohman
--verifier-log-level for Go tests to replace the previous flag name. (#5517) by @mtardy
testify/assert import in lsm_test. (#5874) by @FedeDP
🛠️ Build and dependency maintenance
🧹 Repository maintenance and refactoring
Dependency updates
Update Go, Kubernetes, container runtime dependencies, and supporting libraries, including security fixes. Refresh build tools, container images, Helm charts, GitHub Actions, and VM test images.
Full dependency updates (228 PRs)
🔒 Security updates
🐹 Go toolchain
📦 Container runtime dependencies
☸️ Kubernetes dependencies
📚 Go libraries
🛠️ Build and development tools
🐳 Container images and Helm charts
⚙️ GitHub Actions
💻 VM test images