apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: sensitive-file-access
spec:
  kprobes:
    - call: fd_install
      syscall: false
      return: false
      args:
        - index: 0
          type: int
          maxData: false
          resolve: ""
          returnCopy: false
        - index: 1
          type: file
          maxData: false
          resolve: ""
          returnCopy: false
      selectors:
        - matchArgs:
            - index: 1
              operator: Prefix
              values:
                - /etc/shadow
                - /etc/passwd
                - /etc/gshadow
                - /root/.ssh
                - /etc/kubernetes/pki
                - /var/run/secrets/kubernetes.io
          matchActions:
            - action: Post