Attributed metadata history

v1.7.0

total: 738 commits, prs: 253 pr commits: 738 Upgrade notes Read the upgrade notes carefully before upgrading Tetragon. Depending on your setup, changes listed here might require a manual intervention. See the Stack Traces documentation for stack trace migration. Helm Values Change the default server-address of the agent to from localhost:54321 to /var/run/tetragon/tetragon.sock. This socket is also available for root users under the same path on the node. Update this address in all third-party programs that connect to the agent. Events (protobuf API) The legacy stacktrace-tree API has been removed: GetStackTraceTree gRPC, tetra stacktrace-tree CLI command, and related types (GetStackTraceTreeRequest, GetStackTraceTreeResponse, stack.proto). Use TracingPolicy with kernelStackTrace and userStackTrace in the Post action to get stack traces in ProcessKprobe events. See the Stack Traces documentation and examples/tracingpolicy/stack_traces.yaml. The already-deprecated EnableTracingPolicy and DisableTracingPolicy gRPC methods have been actually enforced to return an error when used. For now, enable-deprecated-tracingpolicy-grpc option has been introduced to restore the old behavior. The next release will remove the deprecated methods. Metrics Kprobe and uprobe merge metrics have been consolidated. The following metrics were removed: tetragon_generic_kprobe_merge_errors_total tetragon_generic_kprobe_merge_ok_total They are replaced by tetragon_generic_kprobe_merge_total which includes a status label with values ok or error. The new metric also includes labels curr_type, prev_type (either enter or exit), curr_fn, and prev_fn. Changes Major changes tetragon: Add support to retrieve environment variables (#4184) by @olsajiri tracingpolicy: add matchParentBinaries selector (#4254) by @kobrineli celbpf: evaluate CEL expressions in bpf (#4504) by @kkourt tetragon: Add fentry sensor (#4039) by @olsajiri Add support for spec.hostSelector (#4814) by @tpapagian Bugfixes Fix memory leaks in process and event caches (#4255) by @mtardy feat: allow LSM funcs to be overridden on SLE (#4158) by @holyspectral helm: Handle tetragon.enabled value properly (#4285) by @michi-covalent bug: Avoid overwritten slogLeveler (#4287) by @sayboras Fix LSM sensor failing to load with --enable-cgidmap due to tg_cgtracker_map size mismatch (#4391) by @ariosmon fix(pkg/sensors): fixed ret{k,u}probe_calls map builder invocation. (#4397) by @FedeDP elf: handle spaces found in arm64 stapsdt (#4426) by @andrewstrohman fix(pkg/sensors): fixed {k,u}retprobe args merge helper. (#4494) by @FedeDP uprobe: add support for monitor mode and stats (#4662) by @kkourt fix(grpc/exec): fix RefDec in exit's eventcache path (#4593) by @dwindsor logger: do not ignore time-stamped formats (#4667) by @kkourt fix(pkg/sensors): skip nested ptr detection for indexed array access. (#4519) by @FedeDP add set action stats (#4762) by @kkourt helm: fix rthooks container resources not being applied (#4766) by @PhilipSchmid tetragon: policies can now be loaded even if kptr_restrict is equal to 2 (#4765) by @FedeDP bpf: Fix mnt_namespace RHEL7 fallback writing to wrong field (#4785) by @sayboras Fix tetragon_overhead_program_seconds_total metric to correctly report seconds instead of nanoseconds (#4830) by @danilovid fix(bpf): define _MULTI_KPROBE macro when needed. (#4849) by @FedeDP Fix a infinite loop when using range notation with math.MaxUint64 as upper bound (#4848) by @3u13r pkg/tetragoninfo: read previously ignored value returned by errors.Join in encode configuration function. (#4901) by @mtardy pkg/policyfilter: copy Pod labels to avoid mutations (#4916) by @mtardy fix: handle matchBinaries NotIn when execve_map misses process (#4641) (#4654) by @mann-ds fix: handle matchBinaries NotIn when execve_map misses process (#4641) bpf: zero stale pkey and flags in event_find_curr_probe tests: add matchBinaries NotIn tests for perfring and early-exec cases Add tetragon_process_cache

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.