pool/tetragon
SHA256
6
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: pool:factory
Branches Tags
pool:factory
pool:devel
rpm:factory
rpm:devel
..
compare: rpm:factory
Branches Tags
rpm:factory
rpm:devel
pool:factory
pool:devel

No commits in common. "factory" and "factory" have entirely different histories.
factory ... factory

8 changed files with 24 additions and 186 deletions
Show Stats Expand all files Collapse all files

5
_service
View File

@ -3,11 +3,10 @@
<param name="url">https://github.com/cilium/tetragon</param>
<param name="scm">git</param>
<param name="exclude">.git</param>
<param name="revision">v1.3.0</param>
<param name="match-tag">v1.3.0</param>
<param name="revision">v1.1.2</param>
<param name="versionformat">@PARENT_TAG@</param>
<param name="versionrewrite-pattern">v(.*)</param>
<param name="changesgenerate">enable</param>
<param name="versionrewrite-pattern">v(.*)</param>
</service>
<service name="set_version" mode="manual">
</service>

2
_servicedata
View File

@ -1,4 +1,4 @@
<servicedata>
<service name="tar_scm">
<param name="url">https://github.com/cilium/tetragon</param>
<param name="changesrevision">4a6643e71e2357324ab8ab73ecb7286d73e96ef8</param></service></servicedata>
<param name="changesrevision">2d8f9438b18dff2ec496fda8af65e1620ca68f11</param></service></servicedata>

3
tetragon-1.1.2.obscpio Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:1950e676ca0e469eb0270a7a0d97b5c9f098413d1bd115eb42a9e02d337ee833
size 178684430

3
tetragon-1.3.0.obscpio
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:8b52fe495a79de564a52fc89e5589747d69e20aef7c7f37a32807c105487e99f
size 178766862

163
tetragon.changes
View File

@ -1,166 +1,3 @@
-------------------------------------------------------------------
Fri Dec 13 10:00:07 UTC 2024 - opensuse_buildservice@ojkastl.de
- Update to version 1.3.0:
Large changelog, please find the full changelog here:
https://github.com/cilium/tetragon/releases
* Upgrade notes
Depending on your setup, changes listed here might require a
manual intervention.
- Behavior of export-file-perm flag (and corresponding Helm
value tetragon.exportFilePerm) changed. In case the export
file exists, but has different permissions than specified in
the option, Tetragon will change the file permissions on the
next log rotation. In older versions, log rotation preserved
permissions of the existing file. Before upgrading check if
permissions of the existing export file match the option (600
by default), and set the agent flag or Helm value to the
desired value if needed.
- Events (protobuf API)
New events for syscall64 type
Previous versions of Tetragon did not distinguish between
different ABIs when using the syscall64 type because the
output was just a size_arg with the id. When executing the
getcpu syscall, for example, the JSON for 64- and 32-bits
would be:
"args":[{"size_arg":"309"}]
"args":[{"size_arg":"318"}]
Note that id 318 for x86_64 is a different syscall: getrandom
so we cannot distinguish between a getrandom syscall on
x86_64 and a getcpu call on 32-bit (i386). To address this
issue, the output of syscall64 was changed to a SyscallId
object that also includes the ABI. So the JSON for 64- and
32-bits getcpu now is:
"args":[{"syscall_id":{"id":309,"abi":"x64"}}]
"args":[{"syscall_id":{"id":318,"abi":"i386"}}]
Users that want to maintain the old behavior can use the
--enable-compatibility-syscall64-size-type flag for this
version.
The flag will be removed in v1.4.
- Metrics
tetragon_ratelimit_dropped_total metric is renamed to
tetragon_export_ratelimit_events_dropped_total
* Major Changes:
- IMA hashes in LSM events (#2818) by @anfedotoff
- tetragon: add support for associating pod information when
nested cgroups are used (#3170) by @kkourt
* - Bugfixes:
- Fix clone event eventcache retry handler when missing pod
info. (#2899) by @tpapagian
- pkg/sensors: fix memory use of unloaded sensors (#3021) by
@mtardy
- tetragon: fix the process exit signal when core dumped
(#3039) by @justin0u0
- tetragon: improve how we handle cgroupv1 and cgroupv2 (#3053)
by @tixxdz
- [metrics] Fix overhead_program metrics for return probes
(#3074) by @tpapagian
- exec: fix tracking of matchBinary children (#3186) by @kkourt
-------------------------------------------------------------------
Wed Nov 27 11:11:43 UTC 2024 - opensuse_buildservice@ojkastl.de
- Update to version 1.2.1:
* Prepare for v1.2.1 release
* filters: implement parent_arguments_regex
* chore(deps): update go to v1.22.9
* chore(deps): update docker.io/library/alpine:3.20.3 docker
digest to 1e42bbe
* tetragon: probe_read usage may cause issues with newer kernels
* e2e tests: skip label test on ARM
* workflows: use GitHub arm64 runners instead of actuated
* Add support to exclude valid processes from dump processCache
* tetra: add max-recv-size to processcache dump cmd
* tetra: rewrite dump processcache cmd for correct error code
* tetra: use consistent case in dump cmd and api
* Add support to dump processLRU
* [btf] Flush kernel spec (BTF) after loading a sensor
* [ksyms] Do not cache ksyms to reduce memory consumption
* fix(deps): update module github.com/cilium/cilium to v1.15.10
[security]
* chore(deps): update docker.io/library/golang:1.22.8 docker
digest to 0ca97f4
* chore(deps): update docker.io/library/alpine docker tag to
v3.20.3
* chore(deps): update go to v1.22.8
* fix(deps): update module github.com/containers/common to
v0.60.4 [security]
* chore(deps): update docker.io/library/golang:1.22.6 docker
digest to a632201
* chore: update containers/common
* Remove const from parameters
* bpf: allow all operations for syscall64 type
* watcher: add metrics for deleted pod cache
* watcher: add a deleted pod cache
* watcher: add test for "fast" k8s API server
* watcher: change FindContainer function
* watcher: add a containerIDKey function
* watcher: refactor watcher
* Export EventCache tunables in the Helm Chart
* Reduce the delay in GRPC gotests
* Make EventCache configurable
* helm: Set rthooks.podSecurityContext to empty by default
* helm: Remove deprecated tetragon.skipCRDCreation value
* [bugfix] Fix clone event caching due to missing pod info
-------------------------------------------------------------------
Fri Sep 13 18:27:13 UTC 2024 - opensuse_buildservice@ojkastl.de
- Update to version 1.2.0:
Full changelog see
https://github.com/cilium/tetragon/releases/tag/v1.2.0
* Major Changes
- feat: Username for process_exec events (#2369) by @anfedotoff
- tetragon: Allow persistent enforcement during tetragon
restart (#2600) by @olsajiri
- LSM sensor (#2566) by @anfedotoff
* Bugfixes
- bpf: use CORE for execve hook (#2399) by @kkourt
- Don't create PodInfo if the pod is being deleted (#2431) by
@michi-covalent
- tetragon: allow namespaced and non-namespaced policies to
have the same name (#2337) by @joshuajorel
- operator: Don't start metrics server if Helm value
tetragonOperator.prometheus.enabled is set to false. (#2484)
by @yukinakanaka
- enforcer: fix issue when using multiple calls with fmod_ret
(#2524) by @kkourt
- Reduce the kernel memory footprint (accounted by the cgroup
memory controller) of the stack trace feature when unused.
(#2546) by @mtardy
- Reduce the kernel memory footprint (accounted by the cgroup
memory controller) of the ratelimit feature when unused
(around ~10MB per kprobe). (#2551) by @mtardy
- Reduce the kernel memory footprint (accounted by the cgroup
memory controller) of the fdinstall feature when unused
(around ~11MB per kprobe). (#2563) by @mtardy
- Do not increase the reference count when we cannot find a
parent in kthreads. (#2620) by @tpapagian
- Reduce the kernel memory footprint (accounted by the cgroup
v2 memory controller) of the override feature when unused
(around ~3MB per kprobe). (#2692) by @mtardy
- Fix a bug related to the matchBinaries Prefix operator by
increasing the buffer size used by our dentry walk. Now the
matchBinaries Prefix operator can correctly trigger a match
on any path above 255 chars. (#2764) by @mtardy
- Fix a bug where the tetra getevents command would timeout
even if the connection was successful. (#2765) by @mtardy
- Fix missing cases in the compact encoder for tetra. (#2819)
by @willfindlay
- add support for pod association via cgroup id (#2776) by
@kkourt
- Allow disabling gRPC either by selecting 'enabled:false' in
the helm chart or by passing an empty address to the agent
(#2826) by @kkourt
- Fix tetragon_process_cache_size metric (#2827) by @lambdanis
-------------------------------------------------------------------
Mon Jul 29 18:36:26 UTC 2024 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
- exclude architectures that fail to build due to
'pkg/syscallinfo/syscallinfo.go:39:34: undefined: syscallNames'
errors
-------------------------------------------------------------------
Wed Jun 12 16:18:43 UTC 2024 - opensuse_buildservice@ojkastl.de

6
tetragon.obsinfo
View File

@ -1,4 +1,4 @@
name: tetragon
version: 1.3.0
mtime: 1734081089
commit: 4a6643e71e2357324ab8ab73ecb7286d73e96ef8
version: 1.1.2
mtime: 1718190407
commit: 2d8f9438b18dff2ec496fda8af65e1620ca68f11

24
tetragon.spec
View File

@ -16,25 +16,23 @@
#
%define __arch_install_post export NO_BRP_STRIP_DEBUG=true
%define cli_binary_name tetra
%define cli_package_name tetragon-cli
Name: tetragon
Version: 1.3.0
Version: 1.1.2
Release: 0
Summary: eBPF-based Security Observability and Runtime Enforcement
License: Apache-2.0
URL: https://github.com/cilium/tetragon
Source: tetragon-%{version}.tar.gz
Source1: vendor.tar.gz
BuildRequires: bash-completion
BuildRequires: clang >= 15
BuildRequires: fish
BuildRequires: clang
BuildRequires: go >= 1.22
BuildRequires: llvm
BuildRequires: make
BuildRequires: zsh
ExcludeArch: i586 ppc64le s390x armv7l armv7hl
%description
Cilium’s new Tetragon component enables powerful real-time, eBPF-based Security
@ -96,7 +94,7 @@ zsh command line completion support for %{cli_package_name}.
#
# tetragon
#
go build \
CGO_ENABLED=0 go build \
-mod=vendor \
-buildmode=pie \
-ldflags="-X github.com/cilium/tetragon/pkg/version.Version=%{version}" \
@ -110,7 +108,7 @@ make -C ./bpf BPF_TARGET_ARCH=x86 %{?_smp_mflags}
#
# tetra cli
#
go build \
CGO_ENABLED=0 go build \
-mod=vendor \
-buildmode=pie \
-ldflags="-X github.com/cilium/tetragon/pkg/version.Version=%{version}" \
@ -149,8 +147,8 @@ mkdir -p %{buildroot}%{_datarootdir}/fish/vendor_completions.d/
%{buildroot}/%{_bindir}/%{cli_binary_name} completion fish > %{buildroot}%{_datarootdir}/fish/vendor_completions.d/%{cli_binary_name}.fish
# create the zsh completion file
mkdir -p %{buildroot}%{_datarootdir}/zsh/site-functions/
%{buildroot}/%{_bindir}/%{cli_binary_name} completion zsh > %{buildroot}%{_datarootdir}/zsh/site-functions/_%{cli_binary_name}
mkdir -p %{buildroot}%{_datarootdir}/zsh_completion.d/
%{buildroot}/%{_bindir}/%{cli_binary_name} completion zsh > %{buildroot}%{_datarootdir}/zsh_completion.d/_%{cli_binary_name}
%pre
%service_add_pre %{name}.service
@ -185,12 +183,16 @@ mkdir -p %{buildroot}%{_datarootdir}/zsh/site-functions/
%{_bindir}/%{cli_binary_name}
%files -n %{cli_package_name}-bash-completion
%dir %{_datarootdir}/bash-completion/completions/
%{_datarootdir}/bash-completion/completions/%{cli_binary_name}
%files -n %{cli_package_name}-fish-completion
%dir %{_datarootdir}/fish
%dir %{_datarootdir}/fish/vendor_completions.d
%{_datarootdir}/fish/vendor_completions.d/%{cli_binary_name}.fish
%files -n %{cli_package_name}-zsh-completion
%{_datarootdir}/zsh/site-functions/_%{cli_binary_name}
%dir %{_datarootdir}/zsh_completion.d/
%{_datarootdir}/zsh_completion.d/_%{cli_binary_name}
%changelog

4
vendor.tar.gz
View File

@ -1,3 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:84f2613ed4a842eb2a9dca9bedc0984aff795e75c95652a01023e94f9b4a0ce8
size 12643824
oid sha256:f180e8b2d905bbdf53026da189b19c30d1f1424856ab02770c447ef2bc1a577e
size 13888794