Skip to content

fix(runtime-monitor): move Tetragon gRPC to a Unix socket (CVE-2026-65960) #61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nikiladonya merged 1 commit into from
Oct 20, 2026
Merged

fix(runtime-monitor): move Tetragon gRPC to a Unix socket (CVE-2026-65960) #61

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions docs/guides/help/help.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -371,11 +371,11 @@ To configure the runtime monitor buffer size:
kubectl rollout restart daemonset/<service name> -n <namespace where Runtime Radar is installed>
```

**Changing network ports for the runtime monitor service**
**Changing network ports and the Tetragon socket path for the runtime monitor service**

The runtime monitor service operates in the hostNetwork mode—that is, it uses a network namespace of the host. If a host port is already in use, the service will not track runtime events. You can set ports for the service in the Helm chart configuration file `values.yaml` before installing Runtime Radar. You can also set a port for the tetragon container of the runtime monitor service if the default host port is already in use.
The runtime monitor service operates in the hostNetwork mode—that is, it uses a network namespace of the host. If a host port is already in use, the service will not track runtime events. You can set ports for the service in the Helm chart configuration file `values.yaml` before installing Runtime Radar. The tetragon container of the runtime monitor service no longer uses a network port for the gRPC connection: it accepts gRPC connections over a Unix socket on the host. If necessary, you can change the path to this socket. The tetragon container still exposes Prometheus metrics on a host port (2112 by default). If this port is already in use, set another one by specifying the `runtime-monitor.tetragon.prometheus.port` value.

To set a network port for the runtime monitor service:
To set a network port or the Tetragon socket path for the runtime monitor service:

1. Open the `values.yaml` file in edit mode.

Expand All @@ -391,7 +391,9 @@ To set a network port for the runtime monitor service:
gops: 7000
```

1. If necessary, specify a port for the tetragon container.
1. If necessary, specify the Unix socket path for the tetragon container.

The address must be specified in the `unix:///path/to/socket` format, and the socket must be located in `/var/run/tetragon`. This is the host directory that both the tetragon container and the runtime monitor container mount, so only the socket file name can be changed. TCP addresses are not supported.

Example:

Expand All @@ -403,7 +405,7 @@ To set a network port for the runtime monitor service:
gops: 7000
tetragon:
grpc:
address: "localhost:54321"
address: "unix:///var/run/tetragon/tetragon.sock"
```

1. Apply the changes and exit the edit mode.
Expand Down
38 changes: 20 additions & 18 deletions install/helm/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,8 @@ The following breaking changes apply when upgrading from earlier versions:
- **Connection metadata moved from Secrets to ConfigMaps.** The chart-owned Secrets `postgresql`/`redis`/`rabbitmq`/`clickhouse` no longer carry `<SVC>_ADDR`/`<SVC>_SSL_*`/`<SVC>_TLS_*` keys — those moved to new ConfigMaps `cs-postgresql-config`/`cs-redis-config`/`cs-rabbitmq-config`/`cs-clickhouse-config`. Operators supplying their own auth Secret via `<svc>.auth.existingSecret` or the new `global.<svc>.auth.existingSecret` must scope it to AUTH credentials only (`<SVC>_USER`, `<SVC>_PASSWORD`, `<SVC>_DB` where applicable). Including ADDR/SSL keys in the Secret no longer has any effect; consumers read those from the ConfigMaps.
- **Cross-subchart secret-name propagation requires `global.<svc>.auth.existingSecret`.** Setting only the top-level `postgresql.auth.existingSecret` propagates to sub-chart but NOT to consumer deployments (auth-api, history-api, etc.). To make consumer pods read from your external Secret, use `global.postgresql.auth.existingSecret` (and the corresponding global knobs for redis/rabbitmq/clickhouse). For external services where subchart isn't deployed (`<svc>.deploy=false`), only the global knob is needed.
- **`global.keys.existingSecret` now honored by every consumer.** `cluster-manager` and `public-api` previously hardcoded `cs-keys` for `PUBLIC_ACCESS_TOKEN_SALT_KEY` / `ACCESS_TOKEN_SALT` and silently ignored `global.keys.existingSecret`. They now resolve the keys-secret name through the `common.cs.keys.secretName` helper. Operators using a custom `global.keys.existingSecret` must ensure the Secret contains the `publicAccessTokenSalt` key (in addition to `encryption` and `token`).
- **Tetragon gRPC moved from TCP to a Unix socket.** `runtime-monitor.tetragon.grpc.address` now defaults to `unix:///var/run/tetragon/tetragon.sock` instead of `localhost:54321`. The old TCP listener ran on the host network without authentication, so any `hostNetwork` pod on the node could call privileged Tetragon RPCs (CVE-2026-65960). TCP addresses are no longer supported or tested — the chart schema rejects any address that does not start with `unix://`. The socket directory is fixed at `/var/run/tetragon`: it is the `tetragon-run` hostPath, mounted into both the Tetragon container and the runtime-monitor container, so only the socket file name can be changed.
- **runtime-monitor now needs group root and a `tetragon-run` mount.** Tetragon creates the socket as `root:root` mode `0660`, so the chart now ships defaults for the runtime-monitor DaemonSet where it previously shipped none: `runtime-monitor.containerSecurityContext` gets the repo-standard hardened block (the same one as history-api/kube-manager/notifier/policy-enforcer: `privileged: false`, `allowPrivilegeEscalation: false`, `readOnlyRootFilesystem: true`, `seccompProfile.type: RuntimeDefault`, `seLinuxOptions: {}`) plus `runAsGroup: 0`; `runtime-monitor.podSecurityContext` gets `enabled: true` and `supplementalGroups: [0]` (the devMode fallback, where the container-level securityContext is not rendered); and a top-level `runtime-monitor.volumeMounts` entry mounts `tetragon-run` read-only at `/var/run/tetragon` — the only mount that gives the app container the socket. Note that `readOnlyRootFilesystem: true` is a new constraint on a container that previously ran without any securityContext. Two consequences: admission policies that forbid GID 0 need an exception for this DaemonSet; and overlays that set `runtime-monitor.volumeMounts`, `runtime-monitor.podSecurityContext` or `runtime-monitor.containerSecurityContext` (all previously empty or absent) now silently clobber socket access — **merge with the chart defaults, do not replace them**.

## Uninstalling

Expand Down Expand Up @@ -631,25 +633,25 @@ clickhouse:

### Runtime-monitor component parameters

| Name | Description | Value |
| --------------------------------------------------- | --------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| `runtime-monitor.nodeSelector` | Template to specify the labels of nodes for pod assignment | `{}` |
| `runtime-monitor.configUpdateInterval` | Interval to update the stored configuration | `30s` |
| `runtime-monitor.dnsPolicy` | Configuration of the DNS policy for runtime monitoring | `ClusterFirstWithHostNet` |
| `runtime-monitor.containerPorts.http` | Port that HTTP server should be listening on | `9000` |
| `runtime-monitor.containerPorts.grpc` | Port that GRPC server should be listening on | `8000` |
| `runtime-monitor.containerPorts.gops` | Port that gops agent should be listening on | `7000` |
| `runtime-monitor.tetragon.enableProcessCred` | Enable visibility of capabilities in the exec and kprobe events | `true` |
| `runtime-monitor.tetragon.enableProcessNs` | Enable visibility of namespaces in the exec and kprobe events | `true` |
| `runtime-monitor.tetragon.enableMsgHandlingLatency` | Enable latency monitoring in message handling | `true` |
| `runtime-monitor.tetragon.exportAllowList` | Allowlist for JSON export | `{"pod_regex":["deathstar"],"event_set":["PROCESS_EXEC", "PROCESS_EXIT", "PROCESS_KPROBE", "PROCESS_UPROBE", "PROCESS_TRACEPOINT"]}
| Name | Description | Value |
| --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| `runtime-monitor.nodeSelector` | Template to specify the labels of nodes for pod assignment | `{}` |
| `runtime-monitor.configUpdateInterval` | Interval to update the stored configuration | `30s` |
| `runtime-monitor.dnsPolicy` | Configuration of the DNS policy for runtime monitoring | `ClusterFirstWithHostNet` |
| `runtime-monitor.containerPorts.http` | Port that HTTP server should be listening on | `9000` |
| `runtime-monitor.containerPorts.grpc` | Port that GRPC server should be listening on | `8000` |
| `runtime-monitor.containerPorts.gops` | Port that gops agent should be listening on | `7000` |
| `runtime-monitor.tetragon.enableProcessCred` | Enable visibility of capabilities in the exec and kprobe events | `true` |
| `runtime-monitor.tetragon.enableProcessNs` | Enable visibility of namespaces in the exec and kprobe events | `true` |
| `runtime-monitor.tetragon.enableMsgHandlingLatency` | Enable latency monitoring in message handling | `true` |
| `runtime-monitor.tetragon.exportAllowList` | Allowlist for JSON export | `{"pod_regex":["deathstar"],"event_set":["PROCESS_EXEC", "PROCESS_EXIT", "PROCESS_KPROBE", "PROCESS_UPROBE", "PROCESS_TRACEPOINT"]}
` |
| `runtime-monitor.tetragon.grpc.address` | Set address of Tetragon grpc connection in host:port format | `localhost:54321` |
| `runtime-monitor.tetragon.prometheus.enabled` | Whether to enable exposing Tetragon metrics. | `true` |
| `runtime-monitor.tetragon.prometheus.port` | The port at which to expose metrics. | `2112` |
| `runtime-monitor.tetragon.resources` | Resource configuration for tetragon container | `{}` |
| `runtime-monitor.rabbitmq.queue` | RabbitMQ queue name | `runtime_events` |
| `runtime-monitor.resources` | Resource configuration for runtime-monitor container | `{}` |
| `runtime-monitor.tetragon.grpc.address` | Set address of the Tetragon gRPC connection. Only Unix sockets on the tetragon-run hostPath (unix:///path/to/socket) are supported. | `unix:///var/run/tetragon/tetragon.sock` |
| `runtime-monitor.tetragon.prometheus.enabled` | Whether to enable exposing Tetragon metrics. | `true` |
| `runtime-monitor.tetragon.prometheus.port` | The port at which to expose metrics. | `2112` |
| `runtime-monitor.tetragon.resources` | Resource configuration for tetragon container | `{}` |
| `runtime-monitor.rabbitmq.queue` | RabbitMQ queue name | `runtime_events` |
| `runtime-monitor.resources` | Resource configuration for runtime-monitor container | `{}` |

### Event-processor component parameters

Expand Down
7 changes: 4 additions & 3 deletions install/helm/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -623,8 +623,9 @@
"properties": {
"address": {
"type": "string",
"description": "Set address of Tetragon grpc connection in host:port format",
"default": "localhost:54321"
"description": "Set address of the Tetragon gRPC connection. Only Unix sockets on the tetragon-run hostPath (unix:///path/to/socket) are supported.",
"default": "unix:///var/run/tetragon/tetragon.sock",
"pattern": "^unix://"
}
}
},
Expand Down Expand Up @@ -1322,4 +1323,4 @@
}
}
}
}
}
7 changes: 5 additions & 2 deletions install/helm/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,8 +275,11 @@ runtime-monitor:
exportAllowList: |
{"pod_regex":["deathstar"],"event_set":["PROCESS_EXEC", "PROCESS_EXIT", "PROCESS_KPROBE", "PROCESS_UPROBE", "PROCESS_TRACEPOINT"]}
grpc:
# -- Set address of Tetragon grpc connection in host:port format
address: "localhost:54321"
# values.schema.json pins "pattern": "^unix://" on this key so a TCP override is
# rejected (CVE-2026-65960). readme-generator cannot emit the constraint, so
# re-apply it by hand after regenerating values.schema.json.
# -- Set address of the Tetragon gRPC connection. Only Unix sockets on the tetragon-run hostPath (unix:///path/to/socket) are supported.
address: "unix:///var/run/tetragon/tetragon.sock"
prometheus:
# -- Whether to enable exposing Tetragon metrics.
enabled: true
Expand Down
2 changes: 2 additions & 0 deletions runtime-monitor/.helm/templates/_container_tetragon.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@
name: bpf-maps
- mountPath: "/var/run/cilium"
name: cilium-run
- mountPath: "/var/run/tetragon"
name: tetragon-run
- mountPath: {{ .Values.exportDirectory }}
name: export-logs
- mountPath: "/procRoot"
Expand Down
4 changes: 4 additions & 0 deletions runtime-monitor/.helm/templates/daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,10 @@ spec:
hostPath:
path: /var/run/cilium
type: DirectoryOrCreate
- name: tetragon-run
hostPath:
path: /var/run/tetragon
type: DirectoryOrCreate
- name: export-logs
hostPath:
path: {{ .Values.exportDirectory }}
Expand Down
21 changes: 18 additions & 3 deletions runtime-monitor/.helm/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,22 @@ env:
value: "1000"
- name: TETRAGON_ADDR
value: "{{ .Values.tetragon.grpc.address }}"
volumeMounts:
- name: tetragon-run
mountPath: /var/run/tetragon
readOnly: true
containerSecurityContext:
seLinuxOptions: {}
privileged: false
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
seccompProfile:
type: "RuntimeDefault"
runAsGroup: 0
podSecurityContext:
enabled: true
supplementalGroups:
- 0
postgresql:
enabled: true
rabbitmq:
Expand Down Expand Up @@ -80,7 +96,6 @@ serviceAccount:
annotations: {}
name: ""
podAnnotations: {}
podSecurityContext: {}
nodeSelector: {}
tolerations:
- operator: Exists
Expand Down Expand Up @@ -265,8 +280,8 @@ tetragon:
# -- Whether to enable exposing Tetragon gRPC.
enabled: true
# -- The address at which to expose gRPC. Examples: localhost:54321, unix:///var/run/tetragon/tetragon.sock
# Do not change
address: "localhost:54321"
# Do not switch to TCP
address: "unix:///var/run/tetragon/tetragon.sock"
gops:
# -- Whether to enable exposing gops server.
enabled: true
Expand Down
Loading
Loading