Home
Blog
Cloud Security
February 7, 2023
min

How to deploy Tetragon on an eks cluster

Stream Team
No items found.
No items found.

TL;DR

Deploying Tetragon on an Amazon EKS (Elastic Kubernetes Service) cluster involves a series of steps.

Tetragon is a security observability, and runtime enforcement tool for cloud-native environments, particularly effective in Kubernetes environments. Here’s a general outline of the process:

Prerequisites:

  1. Ensure you have an active AWS account and the AWS CLI installed and configured.
  2. Make sure your EKS cluster is up and running.
  3. Have kubectl installed and configured to interact with your EKS cluster.

Install Tetragon:

Tetragon can be installed as a Kubernetes DaemonSet. This ensures that it runs on each node of your cluster.

You can use a Helm chart provided by Tetragon, or apply Kubernetes manifests directly.

Helm Installation (Recommended):

  1. Add the Tetragon Helm repository:
  2. Copy code - helm repo add tetragon https://charts.tetragon.io
  3. Update your local Helm chart repository cache - helm repo update

Install the Tetragon Helm chart:

  1. helm install tetragon tetragon/tetragon

‍

Configure Tetragon:

  1. After installation, you might need to configure Tetragon according to your security and observability needs.
  2. This can include setting up logging, metrics, and defining security policies.

Verify Installation:

Once Tetragon is deployed, verify its operation: kubectl get pods -n kube-system | grep tetragon

  1. Check for logs or events to ensure it is functioning as expected.

Read more here - https://tetragon.io/docs/getting-started/install-k8s/

About Stream Security

Stream is the AI-native platform built to fight AI-enabled attacks. It autonomously prevents, detects, hunts, and remediates exposures and threats across production at machine speed - driving risk toward zero. It replaces the fragmented stack of scanners, runtime agents, exposure tools and playbooks with one live model of production.Defending Production needs a new approach: Stream is the only Autonomous Production Defense Platform that works across your entire production estate. It runs on a patented CloudTwin®, a high-fidelity security data harmonization layer that models Cloud, SaaS, identity, runtime, AI, network, perimeter, on-prem, security controls, and the behavior running on top of them into one live model of production: real-time, fully correlated, continuously updating. Not a snapshot. And it does not stop at boundaries - the boundaries that fragment every other tool are the same boundaries an attacker moves across. Inside CloudTwin they are one system.

Stream Team
Related Articles
All
Cloud Security
articles >
CVE-2026-31431: how Copy Fail behaves in Kubernetes
Cloud Security
CVE-2026-31431: how Copy Fail behaves in Kubernetes
A critical Linux kernel vulnerability (CVE-2026-31431, "Copy Fail") allows an unprivileged process to corrupt any file's in-memory copy without writing to disk. In Kubernetes, this means an attacker in one pod can inject malicious code into binaries used by other pods on the same node - without any special permissions, without container escape, and without leaving a trace on the filesystem. We validated this on a live EKS cluster and built runtime detection for it.
Petr Zuzanov
May 4, 2026
min
Axios Compromised: The 2-Hour Window Between Detection and Damage
Cloud Security
Axios Compromised: The 2-Hour Window Between Detection and Damage
Hours ago, axios - one of the most popular npm packages with 60M+ weekly downloads - was compromised. Malicious versions dropped a multi-platform RAT with anti-forensic cleanup. This is the second major supply chain attack in a week, days after TeamPCP's Trivy/LiteLLM campaign. The CI/CD scanner side of this story is well-documented. This post is about what happens after the malware runs - because that's where most organizations actually fail.
Petr Zuzanov
Mar 31, 2026
min
TeamPCP's LiteLLM Takeover: A Cascading Supply Chain Attack Across Five Ecosystems
Cloud Security
TeamPCP's LiteLLM Takeover: A Cascading Supply Chain Attack Across Five Ecosystems
TL;DR: A single compromised CI/CD token cascaded into the largest multi-ecosystem supply chain attack of 2026 - hitting GitHub Actions, Docker Hub, npm, OpenVSX, and PyPI in under a week. LiteLLM - one of the most widely deployed AI/ML packages in cloud environments - was among the targets. Here's the full attack chain, what the malware does, and how to detect it in your cloud infrastructure.
Petr Zuzanov
Mar 31, 2026
6
min

We wouldn’t believe it either.

Get a demo