1.30.0 — 21st July
Updates
Configurable DNS policy in Helm
You can now set the Kubernetes DNS policy for the eBPF agent through a Helm value, giving you control over how the agent's pods resolve DNS in your cluster.
Resolved Issues
Security updates for bundled system packages
This release resolves multiple high- and medium-severity vulnerabilities (CVEs) in third-party system packages included in the agent image, including curl, ncurses, perl, gzip, and nghttp2, by updating them to their patched versions.
1.29.2 — 11th June
Resolved Issues
Resolved process filter for Kubernetes not taking effect
Resolved an issue where the include_processes filter was not taking effect for Kubernetes deployments. Process filtering now applies correctly in Kubernetes environments, ensuring traffic capture is restricted to the configured processes as expected.
1.29.1 — 8th June
Updates
Added configuration to force use of shared probe
A new configuration option is available to force the eBPF agent to use a shared probe, addressing scenarios in which DaemonSet pods may take an extended time to terminate during Helm upgrades.
This option is useful in deployments where probe-sharing reduces pod lifecycle delays, particularly when capture_all_namespaces is enabled.
Process filtering using include_processes is now supported in Kubernetes
The include_processes filter, previously available only for non-Kubernetes deployments, now also works for Kubernetes deployments. This allows you to restrict traffic capture to specific processes in Kubernetes environments, consistent with the behavior already available in VM and bare-metal deployments.
Resolved Issues
Resolved static attach failure when installing via tarball
Resolved an issue where static attach would fail when the eBPF agent was installed using the tarball-based install script.
The install script was not correctly substituting the /etc path for all configuration entries, leaving one path unrewritten. The script has been corrected, and static attachment now works as expected for tarball installations.
Resolved UTF-8 errors caused by unknown decompression
Resolved an issue where unknown or unsupported decompression formats in captured traffic could result in UTF-8 encoding errors. The agent now gracefully handles unrecognized decompression types, preventing malformed data from causing downstream parsing failures.
1.29.0 — 22nd May
Updates
Updated container entrypoint script
The eBPF agent container entrypoint script has been updated to improve startup behavior and compatibility across supported deployment environments.
Resolved Issues
Resolved memory leak in Kubernetes watchers, causing high CPU usage
Resolved a memory leak in the Kubernetes watcher components that caused unbounded memory growth over time. As memory accumulated, the Go runtime spent increasing CPU time on garbage collection, resulting in high CPU usage even on nodes with minimal traffic.
The leak has been fixed, reducing both memory consumption and CPU overhead for Kubernetes deployments.
Resolved eBPF environment being overridden by agent actions configuration
Resolved an issue where certain configuration fields, such as the environment name, could be unintentionally overridden when agent actions applied a configuration update via EBPF_CONFIG_OVERRIDE_BASE64.
The eBPF agent now correctly excludes protected configuration fields from being overridden by agent actions, ensuring the originally configured environment and other installation-time settings are preserved.
1.28.6 — 25th April
Updates
Detection configuration support added to the eBPF agent
The eBPF agent now includes an updated Go Agent that supports detection configuration. This enables the eBPF agent to apply detection rules configured in the platform, ensuring consistent security evaluation across eBPF-based deployments alongside other agent types.
Host network support added to Helm charts
The eBPF agent Helm charts now support host network mode. This allows the agent to be deployed withhostNetwork: true, enabling traffic capture in environments where pods must share the host network namespace.
1.28.2 — 8th April
Resolved Issues
Resolved libtraceable metrics exporter connection errors
Resolved an issue where the libtraceable metrics exporter would fail with connection refused errors after metrics were enabled by default in 1.28.0. The metrics configuration wiring has been corrected, ensuring that the OTLP gRPC metrics exporter connects successfully and exports metrics as expected.
Improved handling of gaps in TLS stream
Resolved an issue where gaps in a TLS stream could cause incorrect behavior during traffic capture. The eBPF agent now handles TLS stream gaps more gracefully, improving the reliability of data collection for TLS-encrypted traffic.
1.28.1 — 21st March
Resolved Issues
Resolved Helm deployment failure when updateStrategy is enabled
Resolved an issue where deploying the eBPF agent via Helm would fail with a YAML parse error when deploymentStrategy.updateStrategy.enabled was set to true in values.yaml.
The error occurred due to a YAML formatting issue in the DaemonSet template. The template has been corrected, and Helm deployments with updateStrategy enabled now complete successfully.
1.28.0 — 10th March
Updates
Image ID added to spans for Kubernetes deployments
The eBPF agent now includes the container image ID as an attribute on spans for Kubernetes deployments. This provides additional context for identifying the exact image version running in a pod, which is useful for correlating security events and API activity with specific container images.
Server-Sent Events (SSE) traffic data collection support
The eBPF agent now supports collecting Server-Sent Events (SSE) traffic, capturing SSE event data within spans. This extends observability to APIs that use SSE for streaming responses, enabling analysis of SSE-based traffic alongside standard request-response traffic.
libtraceable metrics enabled by default
libtraceable metrics are now enabled by default in the eBPF agent, providing out-of-the-box visibility into agent performance without requiring additional configuration.
Resolved Issues
Resolved incorrect mTLS flag population in TLS 1.2 connections
Resolved an issue where the mTLS flag was not being correctly populated for TLS 1.2 connections. The flag is now set accurately, ensuring that mutual TLS connections are correctly identified in span data.
1.27.3 — 8th February
Updates
Downgrade Cilium eBPF Version for GKE Autopilot Compatibility
Downgraded the bundled Cilium eBPF version to resolve a compatibility issue introduced after the upgrade in eBPF agent version 1.26, which affected GKE Autopilot 1.34 and later.
1.27.2 — 8th February
Updates
Add 6.12.+ BTF in eBPF Package and Images
Added support for Linux kernel 6.12 and later BTF files in the eBPF package and container images to improve compatibility with newer kernel versions.
1.27.1 — 16th January
Updates
Add Compression for Span Export
Added support for compressing spans during export to reduce network bandwidth usage and improve export efficiency.
Switch Sampling Engine Order to Prioritize Protection Span Rules
Updated the sampling engine order so that protection span rules are evaluated with higher priority, ensuring more accurate enforcement of protection policies.
Set TA_DATA_DIR by Default Across Deployments
Set TA_DATA_DIR by default across all deployment methods, including rpm, deb, install script, Helm, Terraform, and ECS, to ensure consistent data directory configuration.
1.27.0 — 6th January
Updates
Token-Based Auth Support for TPA Connection
Added support for reporting token-based authentication between the eBPF tracer and the platform. When tracer authentication is enabled in TPA, and a valid reporting token is configured in the eBPF settings, spans are successfully exported to the platform.
Resolved Issues
Upgrade crypto and rardecode to Fix Vulnerabilities
Upgraded crypto and rardecode dependencies to address known security vulnerabilities.
ECS CloudFormation Template Fix
Resolved issues in the ECS CloudFormation template to improve deployment reliability.