From 308145cc901c41714d0afee2f03a1796ca7b0ba1 Mon Sep 17 00:00:00 2001
From: Scooby Husky <garrettstone499@gmail.com>
Date: Tue, 10 Mar 2026 17:39:38 -0500
Subject: [PATCH] Add followChildren default to tetragon shell-execution
 TracingPolicy

The Tetragon CRD defaults followChildren to false in matchBinaries,
causing ArgoCD ServerSideDiff to detect a permanent diff.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 infrastructure/tetragon/tracing-policies/process-execution.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/infrastructure/tetragon/tracing-policies/process-execution.yaml b/infrastructure/tetragon/tracing-policies/process-execution.yaml
index e0d92b9..7160e97 100644
--- a/infrastructure/tetragon/tracing-policies/process-execution.yaml
+++ b/infrastructure/tetragon/tracing-policies/process-execution.yaml
@@ -20,6 +20,7 @@ spec:
                 - "59"  # execve
           matchBinaries:
             - operator: In
+              followChildren: false
               values:
                 - /bin/sh
                 - /bin/bash