5detect-k8sapi-invoke.yaml

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "detect-k8sapi-invoke"
spec:
  kprobes:
  - call: "security_file_permission"
    syscall: false
    return: true
    args:
    - index: 0
      type: "file" # (struct file *) used for getting the path
    - index: 1
      type: "int" # 0x04 is MAY_READ, 0x02 is MAY_WRITE
    returnArg:
      index: 0
      type: "int"
    returnArgAction: "Post"
    selectors:
    - matchArgs:      
      - index: 0
        operator: "Prefix"
        values:
         - "/usr/local/lib/python3.10/dist-packages/kubernetes/client/"
      - index: 1
        operator: "Equal"
        values:
        - "4" # MAY_READ