Get started

eBPF kernel plane (Enterprise R4)

Optional audit metadata for exec and socket connect — Enterprise only, not TLS decryption.

View as Markdown

When to use: Regulated Enterprise programs (e.g. bank phase 2+) that need kernel-level visibility into process exec and socket connect attempts — alongside the NHIM sidecar, not instead of it.

Honesty

  • Observes exec + connect metadata — does not decrypt TLS.
  • Default mode: audit (forward events to sidecar SIEM pipeline).
  • Enforce (kill/deny) requires dual control in the app + platform SCC approval.
  • Not included in Standard or Fleet by default — opt-in DaemonSet.

Architecture

flowchart LR
  EBPF[Kernel sensor DaemonSet] -->|POST /v1/kernel/events| Sidecar[NHIM sidecar]
  Sidecar --> SIEM[SIEM / Activity metadata]

Install (Helm)

Prerequisite: sidecar installed in namespace blekline.

helm upgrade --install kernel-sensor deploy/k8s/ebpf/helm/blekline-kernel-sensor \
  -n blekline -f deploy/k8s/ebpf/values-audit.yaml

Image: ghcr.io/blekline/kernel-sensor:0.1.0-r4

Modes (BLEKLINE_KERNEL_PLANE_MODE):

ModeBehavior
autoTry eBPF; fall back to /proc audit scan
ebpfRequire eBPF attach
procUserspace audit only

OpenShift requires privileged SCC — see Enterprise implementation checklist.

Operators: docs/enterprise-private/R4_EBPF_KERNEL_PLANE_RUNBOOK.md.