Add Tetragon runtime detection

bootstrap/platform/variables.tf

@@ -251,5 +251,27 @@ variable "extra_helm_releases" {
     set_values       = map(string)
   }))
 
-  default = {}
+  default = {
+    tetragon = {
+      repository       = "https://helm.cilium.io"
+      chart            = "tetragon"
+      version          = ""
+      namespace        = "kube-system"
+      create_namespace = false
+      timeout          = 600
+      values_yaml      = <<-EOT
+        tetragon:
+          enableProcessCred: true
+          enableProcessNs: true
+          exportFilename: /var/run/cilium/tetragon/tetragon.log
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              memory: 512Mi
+      EOT
+      set_values       = {}
+    }
+  }
 }

docs/jeannie.1.md

@@ -163,6 +163,10 @@ targets.
 : Summarize recent Gitea and Traefik logs for common scanner paths, suspicious
 user agents, auth failures, and HTTP errors.
 
+`security-runtime`
+: Check the Tetragon runtime-detection DaemonSet and print the command for
+watching recent events.
+
 `apps/security-lab`
 : GitOps-managed internal namespace for intentionally vulnerable practice
 targets. Use `kubectl port-forward`; do not expose it publicly.

jeannie

@@ -5810,6 +5810,25 @@ security_logs() {
     "${REPO_ROOT}/scripts/security-logs"
 }
 
+security_runtime() {
+    require_debian_server "security-runtime"
+    if ! command -v kubectl >/dev/null 2>&1; then
+        echo "kubectl is required for security-runtime." >&2
+        exit 1
+    fi
+
+    kubectl --kubeconfig "${KUBECONFIG}" -n kube-system rollout status daemonset/tetragon --timeout=30s
+    kubectl --kubeconfig "${KUBECONFIG}" -n kube-system get pods -l app.kubernetes.io/name=tetragon -o wide
+    cat <<'EOF'
+
+Watch recent Tetragon events:
+  kubectl -n kube-system logs -l app.kubernetes.io/name=tetragon -c export-stdout --tail=100 -f
+
+Useful practice trigger:
+  kubectl -n security-lab exec deploy/juice-shop -- sh -c 'id; uname -a'
+EOF
+}
+
 case "${1:-}" in
     up)
         up
@@ -5941,6 +5960,9 @@ case "${1:-}" in
     security-logs)
         security_logs
         ;;
+    security-runtime)
+        security_runtime
+        ;;
     openwrt)
         openwrt
         ;;
@@ -5952,7 +5974,7 @@ case "${1:-}" in
         echo "Log: ${JEANNIE_LOG_FILE}"
         ;;
     *)
-        echo "Usage: $0 {up|plan [all|provisioning|cluster|platform|apps|edge]|rebuild-cluster|stop-cluster|start-cluster|status|apps|website-translation-model|website-ollama-listen|ollama-setup|deploy-gitea|rpi-services|bootstrap-gitea-repo|backup-gitea|drill-gitea-restore|install-gitea-runner|move-prometheus-stack-workers|doctor-versions|doctor-edge|doctor-gitea|doctor-rpi|doctor-cluster|preflight|doctor-preapply|inventory-check|state-backup|fix-debian-docker-root|secrets-init|secrets-check|tailnet-policy-check|ai-index|ai-check|security-scan|security-prepare|security-zap|security-k8s|security-host|security-trivy|security-secrets|security-nuclei|security-web|security-logs|openwrt|nuke}"
+        echo "Usage: $0 {up|plan [all|provisioning|cluster|platform|apps|edge]|rebuild-cluster|stop-cluster|start-cluster|status|apps|website-translation-model|website-ollama-listen|ollama-setup|deploy-gitea|rpi-services|bootstrap-gitea-repo|backup-gitea|drill-gitea-restore|install-gitea-runner|move-prometheus-stack-workers|doctor-versions|doctor-edge|doctor-gitea|doctor-rpi|doctor-cluster|preflight|doctor-preapply|inventory-check|state-backup|fix-debian-docker-root|secrets-init|secrets-check|tailnet-policy-check|ai-index|ai-check|security-scan|security-prepare|security-zap|security-k8s|security-host|security-trivy|security-secrets|security-nuclei|security-web|security-logs|security-runtime|openwrt|nuke}"
         exit 1
         ;;
 esac

security/README.md

@@ -13,6 +13,7 @@ Use Jeannie from the Debian homelab host:
 ./jeannie security-host
 ./jeannie security-web
 ./jeannie security-logs
+./jeannie security-runtime
 ```
 
 The default `security-scan` runs:
@@ -36,6 +37,7 @@ The focused commands are:
   web targets.
 - `security-logs`: read-only summary of recent Gitea and Traefik security
   signals.
+- `security-runtime`: Tetragon rollout check and event-log helper.
 
 Reports are written to:
 
@@ -66,3 +68,6 @@ client/server errors before opening the raw logs.
 The `apps/security-lab` GitOps app deploys intentionally vulnerable targets for
 practice. They use ClusterIP services only and should be accessed with
 `kubectl port-forward`, not public ingress.
+
+Tetragon is installed by the platform stack as a runtime visibility tool. Use it
+to learn what container process execution looks like after a pod is compromised.