tetragon

1
apiVersion: cilium.io/v1alpha1
2
kind: TracingPolicy
3
metadata:
4
  name: "datagram"
5
spec:
6
  kprobes:
7
  - call: "sk_alloc"
8
    syscall: false
9
    return: true
10
    args:
11
      - index: 1
12
        type: int
13
        label: "family"
14
    returnArg:
15
      index: 0
16
      type: sock
17
    returnArgAction: TrackSock
18
    selectors:
19
      - matchArgs:
20
        - index: 1
21
          operator: "Equal"
22
          values:
23
          - "2"
24
  - call: "__sk_free"
25
    syscall: false
26
    args:
27
      - index: 0
28
        type: sock
29
    selectors:
30
      - matchActions:
31
        - action: UntrackSock
32
          argSock: 0
33
  - call: "__cgroup_bpf_run_filter_skb"
34
    syscall: false
35
    args:
36
      - index: 0
37
        type: sock
38
      - index: 1
39
        type: skb
40
      - index: 2
41
        type: int
42
        label: "send"
43
    selectors:
44
      - matchArgs:
45
        - index: 1
46
          operator: "DAddr"
47
          values:
48
          - "127.0.0.1/32"
49
        - index: 1
50
          operator: "Protocol"
51
          values:
52
          - "IPPROTO_UDP"
53
        matchActions:
54
        - action: Post
55
          rateLimit: "5"
56