Add support for matchWorkloads selector by tpapagian · Pull Request #4833 · cilium/tetragon

tpapagian · 2026-04-08T14:46:20Z

This works in a similar way to global workload selectors but allows to do fine-grain workload selection inside a single tracing policy.

Example:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "file-monitoring-filtered"
spec:
  kprobes:
  - call: "security_file_permission"
    syscall: false
    return: true
    args:
    - index: 0
      type: "file" # (struct file *) used for getting the path
    - index: 1
      type: "int" # 0x04 is MAY_READ, 0x02 is MAY_WRITE
    returnArg:
      index: 0
      type: "int"
    selectors:
    - matchArgs:      
      - index: 0
        operator: "Prefix"
        values:
        - "/etc/shadow"
      - index: 1
        operator: "Equal"
        values:
        - "2" # MAY_WRITE
      matchWorkloads: # match only host workloads
      - hostSelector: {}
    - matchArgs:      
      - index: 0
        operator: "Prefix"
        values:
        - "/etc/shadow"
      - index: 1
        operator: "Equal"
        values:
        - "4" # MAY_READ
      matchWorkloads: # match host workloads and pods inside "kube-system" namespace
      - hostSelector: {}
        podSelector:
          matchExpressions:
          - key: "k8s:io.kubernetes.pod.namespace"
            operator: In
            values:
            - "kube-system"

More details can be found in each patch.

netlify · 2026-04-20T10:26:37Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`9161377`
🔍 Latest deploy log	https://app.netlify.com/projects/tetragon/deploys/69fd8e015529e80008869b17
😎 Deploy Preview	https://deploy-preview-4833--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

mtardy

Thanks!! A few comments, I think it's almost good to go :)

mtardy · 2026-05-04T09:33:33Z

+	ContainerSelector *slimv1.LabelSelector `json:"containerSelector"`
+	// +kubebuilder:validation:Optional
+	// HostSelector selects hosts that this policy applies to.
+	// For now only ~ (none) and {} (all) is supported.


note: maybe we can X-Validation that only ~ and {} is supported?

Yes, this make sense, I have added:

// +kubebuilder:validation:XValidation:rule="!has(self.matchLabels) && !has(self.matchExpressions)",message="The hostSelector should be either null or {}."

that seems to work.

I have also created #4947 to add the same validation check in the global spec.hostSelector.

mtardy · 2026-05-04T09:39:13Z

+	// to be {}. This will match everything and for this reason we should not use
+	// a policyfilter at all.
+	matchAll := func(s *slimv1.LabelSelector) bool {
+		return (s != nil && (len(s.MatchLabels)+len(s.MatchExpressions) == 0))


Does that work here to compare to an empty LabelSelector? like LabelSelector{}?

Seems to work with DeepEqual. I have changed that as it make the code cleaner.

mtardy · 2026-05-04T09:41:23Z

+		return nil
+	}
+
+	// If the user specifies a podSelector but don't specify a containerSelector,


small typo: dont -> doesn't. Also in next comment

mtardy · 2026-05-04T09:42:42Z

+
+	// If the user specifies a podSelector but don't specify a containerSelector,
+	// we assume that the user cares for all containers inside the pods that match.
+	if podSelector != nil && containerSelector == nil {


maybe reuse you matchNothing method here for containerSelector? It's fairly trivial but I think it documents well the code. Same after

mtardy · 2026-05-04T09:44:48Z

 	filterMap := program.MapBuilderProgram("filter_map", load)
 	maps = append(maps, filterMap)

+	workloadsMap := program.MapBuilderProgram("workloads_map", load)


maybe make workloads_map a const somewhere and reference it every time you use it?

I would propose to leave it as it is for now because it is not clear to me on where is a good place to add this const. Possibly pkg/selectors/kernel.go but this will not make things consistent as it is now in the previous program.MapBuilderProgram calls in the same file. If you have anything specific in mind, just let me know.

mtardy · 2026-05-04T09:46:19Z


+## Workloads filter
+
+Workloads filter can be specified under the `matchWorkloads` field and provide


provide -> provides

mtardy · 2026-05-04T09:47:56Z

+
+This works in a similar way to global workload selectors such as `spec.hostSelector`,
+`spec.podSelector`, and `spec.containerSelector`. More details on these
+can be found in [Filtering semantics](https://tetragon.io/docs/concepts/tracing-policy/k8s-filtering/#filtering-semantics).


please reference the rest of the docs using relative path, here would be

[Filtering semantics]({{< ref "/docs/concepts/tracing-policy/k8s-filtering/#filtering-semantics" >}})

This allows the doc to know at build time if things still exist more importantly and domain name to be changed (if we rename tetragon lol).

tpapagian · 2026-05-04T15:41:55Z

Thanks!! A few comments, I think it's almost good to go :)

Thanks for the review. I believe I have addressed all of your comments.

mtardy

Cool thanks!

Example: apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: "file-monitoring-filtered" spec: kprobes: - call: "security_file_permission" syscall: false return: true args: - index: 0 type: "file" # (struct file *) used for getting the path - index: 1 type: "int" # 0x04 is MAY_READ, 0x02 is MAY_WRITE returnArg: index: 0 type: "int" selectors: - matchArgs: - index: 0 operator: "Prefix" values: - "/etc/shadow" - index: 1 operator: "Equal" values: - "2" # MAY_WRITE matchWorkloads: # match only host workloads - hostSelector: {} - matchArgs: - index: 0 operator: "Prefix" values: - "/etc/shadow" - index: 1 operator: "Equal" values: - "4" # MAY_READ matchWorkloads: # match host workloads and pods inside "kube-system" namespace - hostSelector: {} podSelector: matchExpressions: - key: "k8s:io.kubernetes.pod.namespace" operator: In values: - "kube-system" This will allow us to do fine-grain workload selection inside a single tracing polity. Signed-off-by: Anastasios Papagiannis <anastasios.papagiannis@isovalent.com>

Signed-off-by: Anastasios Papagiannis <anastasios.papagiannis@isovalent.com>

We expect to have a map named workloads_map that have pairs of selector IDs and policy IDs. Then we reuse the policy_filter_check function to check if the policy is applied to a specific selector. In next patches, the agent will populate the workloads_map. The idea is to reuse the existing infra that we have inside policyfilter and is used in global selectors. Signed-off-by: Anastasios Papagiannis <anastasios.papagiannis@isovalent.com>

Will be used in the next patch. Signed-off-by: Anastasios Papagiannis <anastasios.papagiannis@isovalent.com>

In order to achieve that we reuse the existing support for global selectors inside policyfilter. For each selector that has a matchWorkloads filter, we allocate a new policy ID. In order not to collide with global policy IDs we start to allocate IDs after the range of IDs for global selectors. Based on that we assume that each matchWorkloads selector is a global selector and we call AddPolicy with the selector. We also take care of deallocating all of those when a policy is removed. Signed-off-by: Anastasios Papagiannis <anastasios.papagiannis@isovalent.com>

Signed-off-by: Anastasios Papagiannis <anastasios.papagiannis@isovalent.com>

tpapagian changed the title ~~Pr/apapag/match workloads~~ Add support for matchWorkloads selector Apr 8, 2026

tpapagian added the release-note/minor This PR introduces a minor user-visible change label Apr 8, 2026

tpapagian force-pushed the pr/apapag/hostSelector branch 5 times, most recently from a8979e5 to 6db1882 Compare April 16, 2026 07:23

Base automatically changed from pr/apapag/hostSelector to main April 16, 2026 11:34

tpapagian force-pushed the pr/apapag/matchWorkloads branch 3 times, most recently from 754b635 to 76a913b Compare April 17, 2026 14:28

tpapagian force-pushed the pr/apapag/matchWorkloads branch from 89e5241 to 99a256a Compare April 22, 2026 06:39

tpapagian marked this pull request as ready for review April 22, 2026 08:19

tpapagian requested review from a team and mtardy as code owners April 22, 2026 08:19

tpapagian marked this pull request as draft April 27, 2026 11:15

tpapagian mentioned this pull request Apr 27, 2026

Warn on HostSelector != nil in TracingPolicyNamespaced #4896

Merged

tpapagian force-pushed the pr/apapag/matchWorkloads branch 3 times, most recently from 0ebb911 to 7541127 Compare April 29, 2026 09:11

tpapagian marked this pull request as ready for review April 29, 2026 10:09

mtardy reviewed May 4, 2026

View reviewed changes

tpapagian force-pushed the pr/apapag/matchWorkloads branch 7 times, most recently from 6a10f6a to 5401456 Compare May 4, 2026 14:33

tpapagian force-pushed the pr/apapag/matchWorkloads branch from 5401456 to 34dd182 Compare May 4, 2026 14:42

tpapagian requested a review from mtardy May 4, 2026 15:42

kkourt self-requested a review May 5, 2026 07:06

mtardy approved these changes May 5, 2026

View reviewed changes

tpapagian force-pushed the pr/apapag/matchWorkloads branch from 34dd182 to 9161377 Compare May 8, 2026 07:17

tpapagian added 7 commits May 8, 2026 10:19

Populate new tracing policy refs

fd18288

Signed-off-by: Anastasios Papagiannis <anastasios.papagiannis@isovalent.com>

Extract common functionality

bb009f8

Will be used in the next patch. Signed-off-by: Anastasios Papagiannis <anastasios.papagiannis@isovalent.com>

Add new e2e test for matchWorkloads

bc85fb9

Signed-off-by: Anastasios Papagiannis <anastasios.papagiannis@isovalent.com>

docs: Document matchWorkloads selector

23f20b1

Signed-off-by: Anastasios Papagiannis <anastasios.papagiannis@isovalent.com>

tpapagian force-pushed the pr/apapag/matchWorkloads branch from 9161377 to 23f20b1 Compare May 8, 2026 07:20


		## Workloads filter

		Workloads filter can be specified under the `matchWorkloads` field and provide

Conversation

tpapagian commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for tetragon ready!

Uh oh!

mtardy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tpapagian commented May 4, 2026

Uh oh!

mtardy left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tpapagian commented Apr 8, 2026 •

edited

Loading

netlify Bot commented Apr 20, 2026 •

edited

Loading