From 33a3ed55c5ea1dbabc7eba8c70667e08f843629f Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Tue, 16 Apr 2024 08:48:32 +0000 Subject: [PATCH] tetragon: Add process throttle events to events filter Signed-off-by: Jiri Olsa --- install/kubernetes/tetragon/README.md | 2 +- install/kubernetes/tetragon/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/install/kubernetes/tetragon/README.md b/install/kubernetes/tetragon/README.md index 9fa714858f9..4d95afcb6c5 100644 --- a/install/kubernetes/tetragon/README.md +++ b/install/kubernetes/tetragon/README.md @@ -43,7 +43,7 @@ Helm chart for Tetragon | tetragon.enableProcessCred | bool | `false` | | | tetragon.enableProcessNs | bool | `false` | | | tetragon.enabled | bool | `true` | | -| tetragon.exportAllowList | string | `"{\"event_set\":[\"PROCESS_EXEC\", \"PROCESS_EXIT\", \"PROCESS_KPROBE\", \"PROCESS_UPROBE\", \"PROCESS_TRACEPOINT\"]}"` | | +| tetragon.exportAllowList | string | `"{\"event_set\":[\"PROCESS_EXEC\", \"PROCESS_EXIT\", \"PROCESS_KPROBE\", \"PROCESS_UPROBE\", \"PROCESS_TRACEPOINT\", \"PROCESS_THROTTLE\"]}"` | | | tetragon.exportDenyList | string | `"{\"health_check\":true}\n{\"namespace\":[\"\", \"cilium\", \"kube-system\"]}"` | | | tetragon.exportFileCompress | bool | `false` | | | tetragon.exportFileMaxBackups | int | `5` | | diff --git a/install/kubernetes/tetragon/values.yaml b/install/kubernetes/tetragon/values.yaml index 031c976dc59..311b7c7c81e 100644 --- a/install/kubernetes/tetragon/values.yaml +++ b/install/kubernetes/tetragon/values.yaml @@ -85,7 +85,7 @@ tetragon: # exportAllowList: | # {"namespace":["default"],"event_set":["PROCESS_EXEC"]} exportAllowList: |- - {"event_set":["PROCESS_EXEC", "PROCESS_EXIT", "PROCESS_KPROBE", "PROCESS_UPROBE", "PROCESS_TRACEPOINT"]} + {"event_set":["PROCESS_EXEC", "PROCESS_EXIT", "PROCESS_KPROBE", "PROCESS_UPROBE", "PROCESS_TRACEPOINT", "PROCESS_THROTTLE"]} # Denylist for JSON export. For example, to exclude exec events that look similar to # Kubernetes health checks and all the events from kube-system namespace and the host: #