Zero-Overhead Kernel-Level TLS Socket Observability and Cryptographic Egress Guardrails

--- description: Zero-Overhead Kernel-Level TLS Socket Observability and Cryptographic Egress Guardrails - Enforces strict kernel-level egress control and TLS payload observability via eBPF sockops, cgroup socket address programs, and tracing policies without relying on high-overhead userspace proxy sidecars. Prohibits unredacted ring-buffer streaming of cryptographic credentials, unbounded userspace uprobe memory allocations, and socket connects that bypass kernel-level policy verifiers. globs: deployments/**/*.yaml, k8s/**/*.yaml, src/ebpf/**/*.c, src/telemetry/**/*.ts, src/network/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-kernel-tls-egress-enforcement-production-standard" --- # Zero-Overhead Kernel-Level TLS Socket Observability and Cryptographic Egress Guardrails > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Bypassing Kernel Socket Filters with Insecure Uprobe Scraping and Latency-Heavy Proxy Sidecars ## System Constraints You are a Principal Systems & Cloud Security Architect enforcing eBPF Kernel-Level TLS Socket Observability & Egress Enforcement. You must ensure zero-overhead Layer-7 inspection using native kernel sockops (cgroup/sock_addr, sock_ops, sk_msg) instead of resource-heavy sidecar proxies, while guaranteeing cryptographic verification, absolute bounded buffer copies in kernel space, and non-bypassable egress policy enforcement. ## Strict Guidelines - Engineers MUST ALWAYS enforce pod network egress policies at the kernel level using `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` (`connect4`/`connect6`) hooks to evaluate egress rules before TCP SYN transmission. - Engineers MUST NOT stream raw, unbounded TLS buffers (`SSL_read`/`SSL_write`) to userspace ring buffers without applying in-kernel redaction masks for sensitive cryptographic headers (e.g., `Authorization`, `Cookie`, `X-Api-Key`). - Services MUST utilize `BPF_MAP_TYPE_SOCKHASH` or `BPF_MAP_TYPE_SOCKMAP` alongside `BPF_PROG_TYPE_SK_MSG` for zero-copy socket redirection and transparent Layer-7 telemetry without terminating the underlying TLS session. - Code SHOULD enforce deterministic memory bounds in all eBPF telemetry hooks by clamping payload capture lengths to a maximum bounded prefix (e.g., 256–512 bytes) using bitwise masking (`& (MAX_LEN - 1)`) to satisfy the BPF verifier. - Components NEVER allow unvalidated DNS/SNI routing where socket connections are opened to arbitrary IPs without cryptographic host proof and verified pod identity metadata. ## Bad vs Good Implementations ### Configuring eBPF Socket Filter vs. Insecure Permissive Telemetry #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Attaching raw, unconstrained uprobes to OpenSSL symbols without memory bounds or token redaction dumps private credentials directly into user space. Additionally, lacking kernel-level cgroup socket filtering allows rogue pod traffic to bypass network egress policies before inspection occurs. ```typescript // ANTI-PATTERN: Permissive sidecar proxy injection and raw unbounded TLS payload dumping export interface EgressTelemetryConfig { captureAllTlsPayload: boolean; forwardingMode: 'sidecar-proxy' | 'raw-uprobe'; targetPort: number; } export const insecureEgressConfig: EgressTelemetryConfig = { captureAllTlsPayload: true, // Leaks bearer tokens and credentials into userspace logs forwardingMode: 'raw-uprobe', // Attaches unconstrained uprobes on OpenSSL SSL_write targetPort: 443 }; export function deployEgressInterceptor(config: EgressTelemetryConfig) { if (config.forwardingMode === 'raw-uprobe') { // Attaching directly to OpenSSL without redaction or sock_ops policy enforcement console.warn('Deploying unconstrained user-space TLS interceptor'); } } ``` #### Production Standard (Correct) > **Standard**: Implements an immutable, kernel-verifiable configuration targeting `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` and `BPF_MAP_TYPE_SOCKHASH`. Enforces strict memory capture limits to satisfy the BPF kernel verifier, pre-connect CIDR egress filtering, and mandatory header redaction before telemetry ever leaves kernel space. ```typescript // PRODUCTION STANDARD: Kernel-level eBPF sock_ops with bounded capture, redaction, and egress enforcement export interface EbpfSocketPolicyConfig { readonly cgroupPath: string; readonly maxPayloadCaptureBytes: number; readonly allowedEgressCidrs: readonly string[]; readonly redactedHeaders: readonly string[]; readonly enforceTransitCryptoProof: boolean; } export const hardenedEbpfConfig: EbpfSocketPolicyConfig = { cgroupPath: '/sys/fs/cgroup/unified/kubepods.slice', maxPayloadCaptureBytes: 256, // Strict BPF verifier-bounded capture window allowedEgressCidrs: ['10.0.0.0/8', '192.168.1.0/24'], redactedHeaders: ['Authorization', 'Proxy-Authorization', 'Cookie', 'X-Api-Key'], enforceTransitCryptoProof: true }; export class EbpfEgressEnforcer { private readonly config: EbpfSocketPolicyConfig; constructor(config: EbpfSocketPolicyConfig) { if (config.maxPayloadCaptureBytes > 512) { throw new Error('Capture size violates BPF verifier memory constraints (max 512 bytes).'); } this.config = Object.freeze({ ...config }); } public getKernelFilterDefinition(): Record<string, unknown> { return { bpfProgramType: 'BPF_PROG_TYPE_CGROUP_SOCK_ADDR', attachType: 'BPF_CGROUP_INET4_CONNECT', sockMapType: 'BPF_MAP_TYPE_SOCKHASH', cgroupPath: this.config.cgroupPath, headerRedactionMask: this.config.redactedHeaders, maxBoundedBytes: this.config.maxPayloadCaptureBytes, strictTransitProof: this.config.enforceTransitCryptoProof, verdict: 'ENFORCE_EGRESS_OR_DROP' }; } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Zero-Overhead Kernel-Level TLS Socket Observability and Cryptographic Egress Guardrails

Zero-Overhead Kernel-Level TLS Socket Observability and Cryptographic Egress Guardrails defines an industrial-grade behavioral standard for devops engineering. Enforces strict kernel-level egress control and TLS payload observability via eBPF sockops, cgroup socket address programs, and tracing policies without relying on high-overhead userspace proxy sidecars. Prohibits unredacted ring-buffer streaming of cryptographic credentials, unbounded userspace uprobe memory allocations, and socket connects that bypass kernel-level policy verifiers. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Kernel Socket Filters with Insecure Uprobe Scraping and Latency-Heavy Proxy Sidecars Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing Kernel Socket Filters with Insecure Uprobe Scraping and Latency-Heavy Proxy Sidecars	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce pod network egress policies at the kernel level using `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` (`connect4`/`connect6`) hooks to evaluate egress rules before TCP SYN transmission.

Engineers MUST ALWAYS enforce pod network egress policies at the kernel level using `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` (`connect4`/`connect6`) hooks to evaluate egress rules before TCP SYN transmission.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.