Workflow: eBPF & Cluster Security Audit

Auditing the security posture of low-level kernel telemetry agents (OpenTelemetry eBPF, Grafana Beyla) and collector workloads in Kubernetes.

---

Step 1: Scan for Running eBPF Agents

Discover all active eBPF DaemonSets, deployments, and pods running across the cluster:

otel_analyze_ebpf_footprint(namespace="")

---

Step 2: Evaluate Security Context Findings

The tool examines the container runtime manifests against Kubernetes hardening guidelines:

Security Check	Risk Assessment	Recommended Hardening
securityContext.privileged: true	CRITICAL — Container has unrestricted root host access.	Drop privileged mode; grant only specific required Linux capabilities.
hostPID: true	HIGH — Container can inspect and signal all processes on the node.	Restrict to namespaces requiring process-level telemetry.
Overbroad Capabilities	HIGH — Container requests CAP_SYS_ADMIN.	Replace with scoped capabilities: CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN.
Host Volume Mounts	MEDIUM — Mounts /sys/kernel/debug or /lib/modules.	Verify read-only mount flags and scope access to required debugfs paths.

---

Step 3: Generate Hardened DaemonSet Security Context

The tool outputs a least-privilege security context tailored for modern Linux kernels (5.8+):

spec:
  template:
    spec:
      containers:
        - name: beyla-ebpf
          securityContext:
            privileged: false
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
              add:
                - BPF
                - PERFMON
                - NET_ADMIN

Review the remediation diff and apply it to satisfy SOC 2, HIPAA, and CIS Kubernetes benchmarks.