# Tetragon eBPF Runtime Security - Zero Trust Configuration

tetragon:
  exportAllowList: |-
    {"event_set": ["PROCESS_EXEC", "PROCESS_EXIT", "PROCESS_KPROBE", "PROCESS_TRACEPOINT"]}
  prometheus:
    enabled: true
    serviceMonitor:
      enabled: true
      labels:
        release: kube-prometheus-stack
  resources:
    limits:
      memory: 512Mi
    requests:
      cpu: 50m
      memory: 128Mi

export:
  stdout:
    enabledCommand: true
    enabledArgs: true

# Enable JSON event export for log aggregation
exportDirectory: /var/run/cilium/tetragon

# Prometheus metrics
prometheus:
  enabled: true
  serviceMonitor:
    enabled: true
    labels:
      release: kube-prometheus-stack