/docs/concepts/enforcement/ Recent content in Enforcement on Tetragon - eBPF-based Security Observability and Runtime Enforcement Hugo en /docs/concepts/enforcement/persistent-enforcement/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/concepts/enforcement/persistent-enforcement/ This page shows you how to configure persistent enforcement. Concept The idea of persistent enforcement is to allow the enforcement policy to continue running even when its tetragon process is gone. This is configured with the --keep-sensors-on-exit option. When the tetragon process exits, the policy stays active because it’s pinned in sysfs bpf tree under /sys/fs/bpf/tetragon directory. When a new tetragon process is started, it performs the following actions: checks if there’s existing /sys/fs/bpf/tetragon and moves it to /sys/fs/bpf/tetragon_old directory; sets up configured policy; removes /sys/fs/bpf/tetragon_old directory. /docs/concepts/enforcement/persistent-grpc-policies/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/concepts/enforcement/persistent-grpc-policies/ Tetragon can persist tracing policies installed through the gRPC API and restore their desired state after the agent restarts. Combined with persistent enforcement, this allows the old BPF programs to remain active while Tetragon loads replacement programs from the stored policies. This feature applies only to policies installed through gRPC, including policies added with tetra tracingpolicy add. Kubernetes and statically loaded policies continue to be managed by their respective policy sources.