kubelock

kubelock is a Kubernetes security observability agent. It runs as a DaemonSet on every cluster node, connects to Tetragon’s gRPC socket, and ingests kernel-level events — process executions, file opens, network connections, capability changes — then materializes them as a behavioral knowledge graph in Memgraph.

The graph answers questions like:

• Which processes in a namespace opened /etc/passwd?
• Which container made an outbound connection outside its declared egress policy?
• Which process tree led to a binary gaining CAP_SYS_ADMIN?

Pipeline stages

• Stream — dials the Tetragon socket, reconnects with exponential backoff
• Fan-out — discriminates event types and shards to workers by exec_id
• Handler — validates protobuf and transforms it into IR structs
• Writer — batches IR events and flushes to Memgraph over Bolt

All graph writes use MERGE, so writes stay idempotent under event reordering and concurrent workers.